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Foreword 


This study quantifies the relative risk of several different options for the return of Mars surface 
samples to Earth. Risk of mission failure (loss of sample), breach of sample canister that might 
result in back-contamination of Earth with Mars organisms, should they exist, and risk of the 
sample getting too warm are all estimated. This data will help Mars Rover/Sample Return 
Mission Planners select the best method for Earth return. 
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1.0 Executive Summary 


Four options for return of a Mars surface sample to Earth were studied to estimate the risk of 
mission failure and the risk of a sample container breach that might result in the release of 
Martian life forms, should such exist, in the Earth’s biosphere. The probabilities calculated refer 
only to the time period from the last mid-course correction bum to possession of the sample on 
Earth. 

Two extreme views characterize this subject. In one view, there is no life on Mars, therefore 
there is no significant risk and no serious effort is required to deal with back-contamination. In 
the other extreme view, public safety overrides any desire to return Martian samples, and any 
risk of damaging contamination greater than zero is unacceptable. Zero risk requires great 
expense to achieve and may prevent the mission as currently envisioned from taking place. The 
major conclusion of this report is that risk of sample container breach can be reduced to a very 
low number within the framework of the mission as now envisioned, but significant expense and 
effort, above that currently planned will be needed. There are benefits to the public that warrant 
some risk. Martian life, if it exists, will be a major discovery. If it does not exist, there is no 
risk. 

The four options for Earth return studied included: 

Direct Entry - the Sample Return Capsule (SRC) enters the Earth’s atmosphere directly from the 
interplanetary trajectory and descends to the surface with redundant parachutes. An airsnatch of 
the capsule is then assumed to aid in thermal control of the sample. In the event of a missed 
airsnatch, the capsule will land on land. 

Aero and Propulsive Capture to the Freedom Space Station - The SRC is braked aerody- 
namically (aerocapture) or propulsively such that it ends up in an orbit coplanar with Freedom 
Space Station. The altitude of the orbit is assumed to be in die range of 200 to 270 nm (370 to 
500 km) with decay times on the order of a few months to several years depending on the solar 
flux. An Orbital Maneuvering Vehicle (OMV) retrieves the SRC to the Freedom Space Station 
where the sample canister is removed and repackaged in a rugged container designed to maintain 
the required temperature (-40° C). The sample is then returned to Earth in the Orbiter. 

Aerocapture to a Shuttle Compatible Orbit and Shuttle Return - The SRC is braked 
aerodynamically into a 370 km (200 nm) orbit. The Shuttle then retrieves the SRC directly and 
returns it to Earth. 

Table 1.0-1 contains probabilities calculated using a fault tree analysis of the sequence of 
mission events. The probabilities are calculated using estimated probabilities for each of up to 
twenty events in a sequence all multiplied together. Roughly 30 different events are used in the 
calculations. Most of these events occur in several options and therefore the results have a high 
level of relative accuracy although all the estimates may be systematically biased high or low. 

The individual event probability estimates have large uncertainties and the results must be 
viewed with some skepticism. However, these numbers provide a more quantitative assessment 
of the relative risk of contamination of the various return options than has been provided to date. 
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To translate breach of canister probabilities to real back-contamination probabilities, the 
probability that Martian life that can do damage on Earth exists and is capable of surviving the 
interplanetary transfer must be factored in. The probability that Martian life exists, etc., might 
be 0.01 or less, thus divide the canister breach numbers by 100 or 1,000 to get an approximate 
risk of contamination. 

Prior to departure from Mars, a sample transfer from the Mars ascent vehicle to the Earth Return 
Vehicle/Sample Return Capsule is assumed to occur such that the exterior of the returning 
vehicle is sterile. 

The mission success probability estimates are not representative of the entire mission because 
the Earth return is only the end of a much longer sequence. On the other hand, the breach of 
canister estimates are representative of the mission as a whole because almost all the failures 
resulting in sample canister breach occur in the vicinity of Earth. 

The first column below shows the probability of success, where success is defined as simply 
returning the contained sample, even though it may be warm (degraded sample). The 100% 
success column is the probability of returning the contained, temperature controlled sample. 

The degraded sample column in the table refers to the probability that the sample will become 
too warm, significantly warmer than -40° C. The scientific community needs to seriously 
examine what the temperature requirements should be. 

Table 1.0-1, Summary of Fault Tree Calculations 

Option Sample Returned, 100 % Sample Sample Can. Sample 

Bio. Isolated Success Degraded Breached Lost 

(100 Succ. + Sample Degraded) * 


Direct Entry 

98.15 

97.64 

0.55 

0.45 

1.36 

Prop. Capture to 

Freedom Space 
Station 

Aerocapture to 

96.69 

90.38 

6.31 

0.74 

2.57 

Freedom Space 
Station 

96.68 

89.61 

7.07 

1.66 

1.66 

Aerocapture to 

Shuttle 

96.71 

91.72 

4.99 

1.62 

1.66 


The canister is breached in such a manner that contamination of Earth could occur if 
pathogens are on board. This includes several types of breaches: just cracking the seals, 
losing the unsterilized sealed canister on Earth, destruction of the canister and spreading 
of the sample in a crash on Earth, and spreading of the sample in the upper atmosphere 
after a capsule break-up. 
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A simple explanation for the difference between probabilities for direct entry and the other three 
options is the dependence of the three Earth orbit options on one or more Shuttle launches. The 
Shuttle mission success rate is currently 96 % based on 25 launches. Success rates for major 
booster programs such as Araine (81 %), Atlas (80 %), Delta (93 %), Long March (88 %), Titan 
(96 %), Proton (92 %), (Simanis and Gubby, 1988) are all in the range of 85 to 95 %. An 
average over 447 missions for all these vehicles results in a success rate of 91.4 %. No other 
launch vehicle has ever done better than 96 %. Even if the Shuttle success rate goes up to 99 % 
(the actual number used in the calculations), the ability to get a Shuttle into the right orbit on 
time is in question. 

At present, low parking orbits (370 km or 200 nm) are proposed for the return vehicles. These 
orbits can decay within a few months at solar maximum for the aerocapture vehicles under 
discussion. The baseline sample return in 2001 occurs when solar activity is approaching its 
peak. The risks for the options using a low Earth parking orbit can be significantly improved by 
raising the altitude of the parking orbit to allow long life. 

Based on the results in Table 1.0-1, direct entry is die preferred return method. Other evaluation 
criteria, such as the Earth launch mass for the various options, was not considered. The only 
extra-terrestrial sample returns to date (6 Apollos and 3 Lunas) were direct entry. The un- 
manned missions, the Russian Lunas, were parachute landings on land. 

An alternative way to view the different options is in terms of relative complexity. The simpler 
the option, the better the chance of success. To see the simplicity of direct entry relative to the 
other options, consider the approximate number of roughly equivalent operations needed to 
nominally execute the different return options from the last mid-course on. 


Direct Entry 

Aerocapture 

Aerocapture 

Propulsive 


to Shuttle 

to Space Sta. 

Capt. to Space Sta. 

14 

27 

68 

69 


A sensitivity analysis of the Table 1.0-1 results was run to see their sensitivity to changes in the 
individual event probability estimates. The probability of each nominal event was raised to 1.0 
to remove it from the calculation and then the failure probability was increased by a factor of 10 
to make it prominent in the calculation. Figure 1.0-1 shows a scatter plot of all the runs. 
Significantly, the direct entry runs cluster with the least risk for both canister breach and mission 
failure. Direct entry is the preferred option even if any of the component risk element 
numbers is in error by a factor of 10. 

Measures can be taken to significantly reduce the risk of canister breach below the 0.45% 
calculated for direct entry. These include: 

a) Fully redundant subsystems in the ERV and SRC. 

b) Dual main and drogue chutes (already assumed in the calc.) 

c) SCA capable of maintaining seals in a no chute impact. 

d) Ability to flyby Earth until ERV separation. 

e) Flight test for entry vehicle. 


f) Redundant airsnatch aircraft. 

Other risk reduction measures applicable to all the options include: 

a) Cancellation of the sample return portion of the mission if signs of life are seen on Mars by 
the rover. 

b) Monitoring the sterile transfer operation in Mars orbit with TV cameras. Any anomaly 
would be cause to leave the sample in Mars orbit. 
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2.0 Introduction/Mission Description 


This analysis is a top level Failure Mode Effects and Criticality Analysis of the Earth return part 
of the proposed Mars Rover/Sample Return mission. The analysis focuses exclusively on 
category I (Catastrophic Failures which will cause system loss) and category II ( Critical failures 
which will result in major system damage which will result in mission loss). (MIL-STD-1629A) 

The Mars Rover/Sample Return mission will return samples of the Martian surface to Earth. 
Current studies anticipate phase A studies in 1989 with the first launch in 1998/99 and return in 
2001. Various methods of flying the overall mission are still under study. 

Figure 2.0-1 (Cunningham and Kahl, 1988) shows one proposed method. Two separate Titan 4 
with Centaur launches place a rover and an ascent vehicle on the surface of Mars at Mangala (6° 
S, 147° W). The payloads carried to Mars are aerobraked into Mars orbit. The rover has a range 
of 20-40 km. It collects samples and places them in the ascent vehicle for return to Earth. When 
the ascent vehicle is loaded with samples, it launches to orbit and docks with an Orbiter in Mars 
orbit. The Orbiter carries a stage to return the sample to Earth. The sample is placed within this 
stage via a sterile transfer and launched toward Earth. The sample rides in a Sample Canister 
(SC) inside a Sample Canister Assembly (SCA). The SCA is nominally sterile on the exterior. 

When the vehicle reaches the vicinity of Earth, it is composed of two parts, the Earth Return 
Vehicle (ERV) which is a carrier for the Sample Return Capsule (SRC) which enters the 
atmosphere or parks in Earth orbit. On the order of 4 hours prior to Earth entry or Earth orbit 
insertion (EOI), the SRC separates from the ERV. For the aerocapture and direct entry options, 
the ERV will go on to enter the Earth’s atmosphere. 

A significant requirement of the program is to keep the sample at -40°C or below during transit 
(Gooding, 1988). This is to be achieved by an insulated thermal protection cover that opens 
when that end of the vehicle can be pointed at deep space. 

Seven basic options exist for the SRC after separation from the ERV: direct entry to the Earth’s 
surface, aerocapture or propulsive capture to low Earth orbit and Orbital Maneuvering Vehicle 
(OMV) recovery to the Freedom Space Station, aerocapture or propulsive capture to low Earth 
orbit and recovery by the Shuttle, and aero or propulsive capture to elliptical Earth orbit and 
recovery by an upper stage to low Earth orbit. In this study, propulsive capture to the Shuttle, 
which is nearly identical to aerocapture to the Shuttle for the purposes of this study, is not 
considered. Aero or propulsive capture to high elliptical orbits are also not considered. The 
high elliptical orbits are beyond the range of the OMV, and a larger upper stage is required to 
retrieve the sample. 

The following paragraphs describe the return options in more detail: 

1. Direct entry of the sample to the Earth’s surface. The sample return vehicle 
enters the Earth’s atmosphere directly from the interplanetary trajectory, then is 
slowed by aerodynamic braking, and parachutes to a land surface, such as the 
mid-continent U.S. An air recovery (air snatch) with an aircraft retrieving the 
sample before it reaches the surface was baselined to aid in thermal and biological 
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control. A land recovery improves the outcome of various failures, such as a 
missed air snatch, main chute malfunction, or highly off-nominal trajectory. The 
only other unmanned extra-terrestrial sample returns, Lunas 16, 20, and 24 used 
land recovery with no airsnatch. 

Redundant drogue and main chutes are assumed to reduce the probability of 
parachute failure to a small number. The entry vehicle is assumed to be a 
Discoverer-type capsule, not requiring attitude control. Attitude control may 
prove to be needed to achieve an acceptable error ellipse on the ground however. 

2. Aerocapture or propulsive capture to low Earth orbit, and recovery by the 
Space Shuttle, perhaps using the Orbital Maneuvering Vehicle (OMV) to retrieve 
the vehicle in orbit. In this study, the Shuttle is assumed capable of rendez- 
vousing directly with the SRC and grappling it with the Orbiter’s Remote 
Manipulator System (RMS). Use of the OMV significantly complicates the 
mission, but would allow use of a long-life parking orbit for the SRC, at altitudes 
as high as 1,000 nautical miles (nm) or 1,850 km. 

The aerocapture SRC is assumed to be a small Apollo shape capsule that flies a 
profile in the upper atmosphere and then exits when the appropriate amount of 
energy has been dissipated. Following exit from the atmosphere a small bum 
raises the perigee out of the atmosphere and circularizes at a low altitude, 
currently 370 km. The vehicle must maintain attitude control to control the 
temperature of the sample. The current plan calls for the vehicle to remain active 
for 90 days. 

3. Propulsive or aerocapture to the Freedom Space Station. The sample is 
circularized in LEO and then brought to the Freedom Space Station by the OMV. 
The OMV does not normally reside at the Freedom Space Station and must be 
brought to orbit for this purpose. Several options exist for handling the sample at 
the Freedom Space Station. The simplest is taken as the baseline here. The OMV 
is docked on the truss and the RMS places the SRC in a secure container. The 
sample canister assembly is removed from the SRC and placed in another secure 
container, capable of providing active thermal control if required. The two 
containers are returned to Earth in the Orbiter. 

Each option is progressively more complex and interrelated with other programs. Four simple 
criteria are of interest in evaluating the options listed above: 

1 . The probability of 100% mission success. 

2. The risk of breach of container in the biosphere which is related to the risk of 
contaminating Earth with microorganisms from Mars. 

3. The risk of loss of the sample. 
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4. The risk of degradation of the sample. Failure to maintain the required tempera- 
ture (-40°C at present) is an example of this type of failure. This would result in 
a significant loss of information in the sample. 

A significant fraction of the information about Mars stored in the samples may be lost if the 
sample is heated to temperatures above about -15°. The objective of keeping the sample cold is 
to preserve the clay minerals, salts, and water ice (if present) in its Martian condition. These 
materials preserve a record of how the Martian atmosphere and lithosphere have interacted for 
10's of millions, and possibly billions of years. As such, these easily destroyed constituents may 
preserve critical information about whether the Martian climate was ever conducive to life. 
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Figure 2.0-1, Mars Rover/Sample Return Mission Sequence 
(Cunningham and Kahl, 1988) 


MARS ROVER SAMPLE/RETURN: AREAL B 

LAUNCH CONFIGURATION B, AREAL TRAVERSE, SAME LAUNCH OPPORTUNITY 

BOVEB ELEMENT (B2) 


UAAS 



V 
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3.0 Description of the Hardware Elements 

The hardware elements are defined at a pre-phase A level of detail at this point in time. The 
most detailed description available is included here for the sample return hardware in order to try 
to understand a baseline conceptual design that can be evaluated and evolved. 

The following general definitions aid the discussion: 

Sample Canister (SC) - This is the can that carries the sample, sealed on the 

Martian surface. 

Sample Canister Assembly (SCA) - The SC is placed inside this can in Mars orbit. The 

outside of this can is sterile. 


Sample Return Capsule (SRC) - The SRC holds the SCA through aero or propulsive 

braking and while it is in Earth orbit. 


Earth Return Vehicle (ERV) - 


SRC Canister - 


SCA Canister - 


Canister Pallet - 


The ERV carries the SRC through the interplanetary 
voyage from Mars back to Earth. The ERV and SRC 
separate before Earth capture and the ERV flies on by 
Earth or enters, depending on the case. 

When the SRC is brought to the Shuttle or Freedom Space 
Station it is placed in the SRC canister, a sealable can. 
Before the lid is shut, the SCA is removed from the SRC 
and placed in the SCA canister. 

Before the SRC is sealed in its canister, the SCA is 
removed and placed in a smaller canister. This small can 
is arranged to provide thermal control and a redundant 
biological seal. It is also sturdy enough to survive some 
types of Shuttle crashes. 

Both the SRC and SCA Canisters are located on a pallet 
which carries appropriate power hook-ups, thermal 
control, instrumentation, data processing equipment, and 
mechanical connectors for riding in the payload bay down 
to the Earth’s surface and for hook-up to the Freedom 
Space Station truss. 


Orbital Maneuvering Vehicle (OMV)-The OMV is a small spacecraft which will go out and get 

the SRC and bring it back to the Freedom Space Station or 
Shuttle. The OMV does not currently have a home on the 
Phase 1 Freedom Space Station. It must be delivered and 
docked to an enhanced Station some time well before the 
arrival of the SRC at Earth. 
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3.1 Earth Return Vehicle 


The Earth Return Vehicle (ERV) is a spacecraft bus that carries the SRC. It reduces the mass 
that must be inserted into Earth orbit or aerobraked to the surface to a minimum by carrying the 
power, propulsion, and other features needed for the interplanetary flight. 

Figure 3.1-1 (Norton, 1988) shows a sketch of the vehicle with the SRC inside configured for 
propulsive capture. Table 3.1-1 (Norton, 1988) shows amass, power and subsystem breakdown 
of the ERV. This version of the ERV is spin stabilized (6 rpm during cruise). 

Figures 3.1-2 (Lawson, 1988) and 3.1-3 (Lawson, 1988) show an ERV configured to carry an 
aerocapture Sample Return Capsule. Table 3.1-2 (Gamble, 1988) shows a preliminary weight 
statement and subsystem breakdown for this vehicle. Table 3.1-3 (Gamble, 1988) describes the 
ERV propulsion system. 

3.2 Sample Return Capsule 

Figure 3.2-1 (Norton, 1988) shows a Sample Return Capsule configured for propulsive capture 
into LEO. Table 3.2-1 (Norton, 1988) shows a weight and subsystem breakdown for this 
vehicle. The SRC has two stages of propulsion for Earth orbit insertion. The four motors 
marked "1" in the figure do the first bum. The two motors marked "2" do the second bum. The 
vehicle is spun up by the ERV prior to the bum to a high rate. After the bum a "yo-yo" is 
deployed to reduce the spin rate to about 5 to 6 rev./min. This is the only attitude control this 
version of the SRC has. 

Liquid propulsion systems for propulsive capture SRCs are also being considered in addition to 
solids. 

This version of the SRC has a small circumferential solar array and batteries. These operate a 
small S-band beacon. Thermal control is provided by a thin insulated door over the SCA. The 
hinge motor for this door is driven by a small aft-looking thermal sensor. Heat flux above a 
certain limit, detected by this sensor causes the door to close until the flux drops. 

Figures 3.2-2 and 3.2-3 (Norton, 1988) show block diagrams of the power and communications 
and data handling subsystems of the ERV/SRC vehicle. The Mars Orbit Vehicle (MOV) or 
Mars Rendezvous Orbiter (MRO) is also included but is not relevant to this study. 

Figure 3.2-4 (Lawson, 1988) and 3.2-5 (Gamble, 1988) show a representation of the Sample 
Return Capsule (SRC) designed to aerocapture into low Earth orbit (LEO). Table 3.2-2 (Law- 
son, 1988) shows a weight statement and breakdown by subsystem. Table 3.2-3 (Gamble, 1988) 
includes more information on the propulsion system. 

33 Direct Entry Capsule (DEC) 

Figure 3.3-1 (Kenidge and Atzei, 1987) shows a DEC designed for a comet sample retrieval. 
The DEC for MRSR should be similar although the vehicle may have a different aerodynamic 
profile. The DEC does not circularize in Earth orbit, but rather enters directly to the surface, 
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deploys parachutes, and is recovered in the air by a large aircraft before it hits the ground. The 
subsystems for the DEC are predicted to be similar to those in the SRC. 

Figure 3.3-2 shows a discoverer capsule shape, which may prove to be a more desirable profile 
since it is aerodynamically stable in one position without active control. 

3.4 Sample Canister (SC) and Sample Canister Assembly (SCA) 

The Sample Canister is the original can into which die samples are placed on the Martian 
surface. Prior to launch from the surface, it is closed and sealed. Figure 3.4-1 shows a concept 
for this can. The SC is taken to orbit and placed inside the Sample Canister Assembly (SCA). A 
sterile transfer is accomplished, such that when the SCA shuts its lid, the exterior of the SCA is 
sterile. The SCA is contained within the SRC and is thermally controlled by opening and 
shutting a lid that covers it and perhaps by rolling it out on tracks facing deep space. 

3.5 Orbital Maneuvering Vehicle (OMV) 

Figure 3.5-1 shows the OMV and its propulsion module that may have to be changed out 
between SRC retrievals if two vehicles are to be retrieved. A rendezvous sequence performed by 
the OMV may require as many as 10 bums if a Shuttle type maneuver sequence is used. The 
OMV will be commanded from the ground once it is beyond a certain distance from the Freedom 
Space Station. When the OMV is within the Freedom Space Station control zone, it will be 
controlled by the crew in the Station. 

3.6 Canister Pallet 

Figure 3.6-1 (Simonds, 1988) shows a concept for the canister pallet which may hold the 
canisters into which the SRC and SCA will be placed. The canister pallet will be brought up in 
the Shutde payload bay, placed on the Freedom Space Station truss, loaded and sealed with the 
SRC and SCA and then taken to Earth in the Shuttle payload bay. In a pure Shuttle recovery, the 
canister pallet would remain in the payload bay throughout the flight. 
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Figure 3.1-1, Earth Return Vehicle (ERV) with Propulsive Injected SRC 
(Norton, 1988) 


Scale - (m) 


EARTH RETURN VEHICLE (ERV) LAYOUT 
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1 - SRC 
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3 - SRC ADAPTER 
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6 - THRUSTER ASSY. (2) 

7 - STAR 17A MOTOR (4)* 

8 - BUS 


9 - HIGH-GAIN ANTENNA 

10 - PLUME SHIELD t 

11 - LOW-GAIN ANTENNA 

12 - SOLAR ARRAY (ANNULAR) 


t - jettisoned after motor burnout 


Table 3 . 1 - 1 , Earth Return Vehicle System Breakdown, Propulsive Capture SRC 
(Norton, 1988) 


Subsystem/Element 

Mass 

Pwr 

Remarks 


(kg) 

(W) 


Telecommunications: 

(18.4) 

(24.2) 


X-bd. transponder & CDU (2)* 

5.0 

14.0 

(MO) JPL Techn. 

X-bd. SSPA (1.2 W RF) (2) 

2.0 

6.0 

1/4 CRAF (80% CRAF inherit.) 

TMU (2) 

1.1 

3.0 

CRAF (100%) 

Receiver RF Switch 

0.5 

- 

CRAF (50%; less power) 

Transmitter RF switch 

0.5 

- 

CRAF (50%; less power) 

Interface/Control (2) 

2.8 

1.2 

GLL, CRAF 

Cables, hybrids 

1.0 

- 

60% CRAF 

Wave guides 

1.6 

- 

50% CRAF 

Diplexers (2) 

0.8 

- 

CRAF 

Low gain antenna 

0.4 

- 

CRAF 

High gain antenna (1.5m), feed 

1.5 

- 

new 

ERV/MRO RF switches (4) 

1.2 

- 

new 

Power & Pyro: 

(17.1) 

(5.0) 


Solar array (annular body-mtd.) 

2.2 

- 

GaAs, 0.9 m 2 , 57 W @ 1.6 AU 

Batteries 

2.3 

- 

LiTiS 2 , 150 W.h 

Bi-dir. conv., Ctl., Distrib. 

5.6 

4.0 

1/3 of CRAF 

Shunt regulator 

1.6 

1.0 

1/2 of CRAF 

Shunt radiator 

1.8 

- 

1/2 of CRAF 

Pyro switching unit (2) 

3.6 

- 

GLL, CRAF 

Command and Data: 

(11.0) 

(8.8) 


Main unit, TLM & CMD (2) 

10.0 

8.0 

(SME-50%), updated, Gulton 

Data storage 

1.0 

0.8 

(new) 1 Mbyte, solid-state 

Attitude Control: 

(10.8) 

(8.6) 

(spin-stabilized) 

Acquis, sun sensor (3) 

0.3 

0.1 

Pioneer V.(M.-P.)(80%) 

Cruise sun sensor, +/-64 0 FOV (2) 

1.0 

0.6 

ADCOL (off-the-shelf) 

Star sensor 

2.9 

1.0 

Pioneer V.(M.-P.)(80%), Ball 

Attitude data processor 

5.7 

6.9 

Pioneer V.(M.-P.)(60%) 

Nutation damper (passive) 

0.9 

- 

Pioneer V.(M.-P.)(80%) 

Cabling: 

(17.0) 



Sys./subsys. cabling 

16.0 



SRC umbil. cable 

1.0 



Temp. Control: 

(6.0) 



Insulation 

2.8 



Louvers 

2.4 



Heaters 

0.8 

(20.0)** 



* Some numbers in paren. indicate system redundancy 

** Short term, bat. powered 14 



Table 3.1-1, Earth Return Vehicle System Breakdown, Propulsive Capture SRC, Continued 
(Norton, 1988) 


Subsystem/Element 

Mass 

Pwr 

Remarks 


(kg) 

(W) 


Meehan. Devices: 

(4.7) 



SRC release/separ. devices (3) 

2.1 



SRM rel./separ. devices (4) 

1.6 



SRC umbil. cable cutter 

0.1 


GLL 

Plume shield rel./separ. dev. (3) 

0.9 



Structures: 

(46.4) 



Bus. w. equip, supts. 

21.2 


w.GR/Ep reinforced load path 

SRC enclosure 

6.6 


0.9 mm fil.-wound Kevlar/Ep 

SRC adapter 

10.4 


Gr/Ep 

Thruster outriggers (2) 

3.2 



Antenna supports (tripod) 

0.6 



Plume shield 

4.4 


thin Ti, Ti0 2 coated 

Subtotal: 

131.4 

46.6 


Contingency: 

17.7 

7.0 

(18% of 72.5 INTG.,+ 8% of 
58.9 ELEC.; 15% Power) 

Total (dry): 

149.1 

53.6 


RCS (spinner-type): 

(67.8) 


for 200 m/s (TCM and ACS) 

Inerts and supports 

15.8 



Propellant 

52.0 


n 2 h 4 

Subtotal (ERV + RCS): 

216.9 



TEI PROP.: 

(851.7) 


for delta-V = 2023 m/s 

Inerts and supports 

106.3 


4 STAR 17A, stretched 1 1.7 in solid 

Propellant 

745.4 




Total (ERV wet + TEI PROP.): 1 ,068.6 

Cumulative Total (ERV+SRC): 1,463.7 (for SRC inj. into 370 km 

circular Earth orbit) 
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Figure 3.1-3, Earth Return Vehicle (ERV) with Aerocapture SRC 
(Lawson, 1988) 
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Table 3.1-2, Earth Return Vehicle Weight Statement, Aerocapture SRC 
(Lawson, 1988) 

Total Total 

Component Dimensions Mass 

Structure 2.74m diax 1.65m height 8.12 kg 

with 1.9m dia x lm height 
cutout for SRC 

Propulsion System 
Engines 

- R-40B engine (1) 7.26 kg 

- R-1E engine (16) 25.4 kg 

Propellant System 

- Fuel 147.9 kg 

Fuel tank (2) 0.28m dia sphere 3.6 kg 

- Oxidizer 244.0 kg 

- Oxidizer tank (2) 0.28m dia sphere 3.6 kg 

- Pressurant 21.8 kg 

- Pressurant tanks (2) 0.16m dia sphere 20.2 kg 

Misc Propulsion 4.1 kg 

Total Propulsion System 477.86 kg 

Thermal Control 1 .36 kg 

Avionics (No computer) 90.7 kg 

High Gain Antennae ? kg 

Solar Panels and Rechargeable 

secondary batteries (150% of required power) ? kg 

ERV total (w/o SRC & Sample) 651.12 


\ 
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Table 3.1-3, Earth Return Vehicle Propulsion System, Aerocapture SRC 
(Gamble, 1988) 

Assume Payload Mass of 360 kg (SRC + SCA) 
Delta V Requirement = 2027 m/sec TEI (Primary) 
= 200 m/sec TCM(RCS) 

Option II - 1 Primary + 16 RCS 


Item 


Primary engine (#) R-40B (1) 

Thrust, lbf (ea) 900 

Isp, sec 309 

Mass, lbm 16.0 

RCS engine (#) R-1E (16) 

Thrust, lbf (ea) 25 

Isp, sec 280 

Mass, lbm 3.5 ea 

Fuel system MMH 

Fuel mass, lbm 326 

Number of tanks 2 

Tank config. Spherical 

Tank radius, ft 0.92 

Tank mass, lbm 3.95 

Oxidizer system NTO 

Ox mass, lbm 538 

Number of tanks 2 

Tank config. Spherical 

Tank radius, ft 0.92 

Tank mass, lbm 3.95 

Pressurization system N2 

Press mass, lbm 4B 

Number of tanks 2 

Tank config. Spherical 

Tank radius, ft 0.54 

Tank mass, lbm 22.25 
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Figure 3.2-1, Propulsive Capture Sample Return Capsule 
(Norton, 1988) 
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Table 3.2-1, Sample Return Capsule (Propulsive) Weight Statement 


(Norton, 1988) 


VEHICLE Mass 

Pwr 

Remarks 

r 

Subsystem/Element 

(kg) 

(W) 



SAMPLE CANISTER ASSY. (SCA) 




Sample 

5.0 

- 


' 

Sample vials (19) 

1.4 

- 



Teflon retainer block 

0.8 

- 



Inner container w. therm, insul. 

1.8 

- 



T & P sensors 0.3 

1.5 

(SRC power) 


Slip ring assy.0.4 

- 




Canister shell w. gasket 

2.6 

- 


r 

Canister thermal insulation 

0.6 

- 



cover, seal mech., and lid assy. 

1.6 

- 



Lid hinge, drive, motor assy. 

0.8 

* 

* (powered from RVR or MAV) 

r 

Seal drive motor 

0.4 

* 

♦(powered from RVR or MAV) 


Lid latch mechanism 

0.4 

9k 

♦(powered from RVR or MAV) 


Retention shafts (2) 

0.6 

- 

Kevlar/epoxy 

r" 

Wiring, drives connector 

0.4 

- 



Subtotal without sample: 

12.1 

1.5 


' 

Contingency: 

2.2 

0.2 

(18% on mass) 


Total without sample: 

14.3 

1.7 



Sample: 

5.0 




Total with sample: 

19.3 

1.7 


* 

SAMPLE RETURN CAPSULE (SRC) 



V 

Electronics: 

(8.9) 




Telecom. + Telem. Unit 

1.6 

3.4 

8 b/s dwnlk.only, omni ant. 


PWR: Solar array 

0.4 

- 

Body mtd., GaAs, 0.15m 2 , 8 W 


Batteries 

1.5 

- 

-LiTiS 2 , 100 W.h 


Condg./Ctl./Distrib. 

1.0 

- 



Event timer 

0.2 

:k 

Solid-state: * - milliwatts 

V 

Pyro unit (2), jettis. squibs 

3.7 

9k 

GLL/CRAF; * - 1 W to charge 


Solar incidence sensor 

0.2 

0.1 



Hinge drive control unit 

0.3 

0.1* 

* - standby power 

V 

Structures, Cabling, Mechanisms: 

(31.9) 




Bus 

9.4 

- 

1 mm AlAly, 4 2 -mm stingers 

V 

Struct, reinforcmt. for SRM’s 

3.6 

- 

1 cm thk. x 10 cm Gr/Ep ring 


SCA retention latch, support 

0.6 

- 

Kevlar/epoxy support 

" 

SCA bmsh block support ring 

3.0 

- 

Kevlar/epoxy 

V 

Radiator support ring 

2.3 

- 

Kevlar/epoxy 


SCA radiator (annular) 

3.7 

- 

1 mm thick Cu, full hard 


Hinged radiator cover 

0.4 

- 

1 mm AlAly, covered with MLI 

V. 

Rad. cover hinge drive 

0.4 

(4.0) 

(intermittent power) 


Despin yo-yo assy. (2) 

1.0 

- 

incl. deploy., separ. mech. 


Internal MLI blankets 

1.3 

- 

1.9 m 2 
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Figure 3.2-2, Power Subsystem, MRO/ERV/SRC 
(Norton, 1988) 



EXT. PWR. 
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Figure 3.2-3, Conununications and Data Subsystems, MRO/ERV/SRC 
(Norton, 1988) 
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Figure 3.2-4, Sample Return Capsule configured for Aerocapture 
(Gamble, 1988) 
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1.80 m 
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Table 3.2-2, Sample Return Capsule (Aerocapture) Weight Statement 
(Lawson, 1988) 


Component 


Total Total 

Dimensions (meters) Mass (kg) 


Sample Canister Assembly ,07m dia, 0.7m height 

cylinder 

Propulsion System (will handle one failure per RCS pod) 

- Oxidizer sphere 

- tank (2) 0.195 dia 


- Fuel 

- tank (2) 


sphere 
0.195 dia 


- Piessurant 
- tank (2) 


sphere 
0.1158 dia 


- R-1E engine (8) nozzle .274m length, .lm dia, scarf 33° 

engine block .13m length, .14m width 
& height 

- R-6E engine (8) nozzle .271m length, .055m dia, scarf 34° 

engine block .13m length, .065m width, 
.075m height 

- Misc Propulsion 
Total Propulsion 

Structure 1.8m scaled Apollo capsule with 

- Capsule 1.0m total height, 0.1m thickness 

- TPS 


Avionics (dual string) 

Computation & Data Handling (1) 

- Computer (2 fault tolerant) .29 , .22w, .19h 

IMU (3) .153 ,.153w,.153h 


19 kg unloaded, 
24 kg loaded 


10.9 kg 
0.18 kg 
6.35 kg 
0.18 kg 
0.91 kg 
0.91 kg 

25.4 kg 


10.9 kg 


1 MU 

57 kg 

70 kg 

J4kg 
144 kg 


20 kg 
6 kg 
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Table 3.2-2, Sample Return Capsule (Aerocapture) Weight Statement, Continued 
(Lawson, 1988) 



Total 

Total 

Component 

Dimensions (meters) 

Mass (kg) 

Power (3 Battery Packs) 150% of req. 

.254 , .254w, .20h 

16 kg 

Power Distribution & Control/RCS Control Electronics (dual string), from AFE 

- Control Electronics 

.20 , .38w, .23h 

35 kg 

- Power Amplifier 

.254 , .06w, .13h 

2 kg 

- RF Switch (2) 

.076 , .05w, .038h 

1kg 

- Diplexer 

.15 ,.05w,.044h 

1kg 

- RF Filter 

.13 ,.03w,.025h 

1 kg 

Total (Power Dist) 


40 kg 

Communications (taken from AFE) (2) 



- Electronics/transceivers (2) 

.29 ,.22w,.19h 

10 kg 

- Antennas (2) 

.203 dia half sphere 

0 kg 

- Transponder (1) 

.33 , .14w, .14h 

5ke 

Total (Communications) 


15 kg 

Star Tracker (2) (from AFE) 

.168 , .18w, .31h 

10 kg 

Sample Return Capsule Accounted Mass (without SCA) 

308 kg (679 lbs) 

Sample Return Capsule Accounted Mass with SCA 

327 kg (721 lbs) 

Sample Return Capsule Accounted Mass with SCA & Sample 

332 kg (732 lbs) 


* no thermal control mass growth included 
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Table 3.2-3, SRC Propulsion System 
(Gamble, 1988) 

Item 

Primary engine (#) R-1E (8) 

Thrust, lbf (ea) 25 

Isp, sec 280 

Mass, lbm 7.0 

Secondary engine (#) R-6C (4) 

Thrust, lbf (ea) 5 

Isp, sec 290 

Mass, lbm 3.0 

Fuel system MMH 

Fuel mass, lbm 14.0 

Number of tanks 2 

Tank config. Spherical 

Tank radius, ft 0.32 

Tank mass, lbm 0.2 

Pressurization system N2 

Press mass, lbm 2.0 

Number of tanks 2 

Tank config. Spherical 

Tank radius, ft 0.19 

Tank mass, lbm 1.0 
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Figure 3.3-1, Direct Entry Capsule 

(Kerridge and Atzei, 1987) 
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Figure 3.3-2, Discoverer Capsule Dimensions 
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Figure 3.4-1, Sample Canister Assembly 

(French and Blanchard, 1985) 
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4.0 Comparable Operations in Each Sequence 

This report presents two different methods of assessing the risk of various types of failures of the 
earth return phase of the mission. The first method is to compare the nominal operational 
sequences of each option. 

Table 4 . 0-1 shows the top level sequence for several options. A rough comparison of the com- 
plexity of the options can be seen by comparing the steps in each sequence. Some steps, such as 
a shutde launch, are really far more complex in terms of sequential steps than is shown here, but 
the general trend is correct. The sequence is for a single mission only. A dual mission has 
additional steps in some options, such as refueling the OMV. 

Several key points can be inferred from Table 4.0-1. First, the first five steps are common to all 
options. Thus to a first approximation, the probability that these events go nominally does not 
affect the relative risk of the options. The second inference is that the Space Station based 
options require nearly twice as many steps as those partly dependent on the Shuttle, and those 
depending on the Shutde have nearly twice as many steps as direct entry. 

Thus, to bring the complex Space Station based options to a similar level of reliability as the 
shutde based or direct entry option will require significant extra redundancy and other risk 
reduction techniques. Similarly, bringing the shuttle based options up to the level of reliability 
of the simpler direct entry case will require significant effort. Sections 5 and 6 of this report 
provide detail on the individual steps and how they link together in both nominal and off- 
nominal missions. 


35 


Table 4.0-1, Top Level Sequence for Return Options 

Aerocapture to Propulsive Capture Aerocapture to Propulsive Capture Direct Entry 

Space Station to Station Shuttle to Shuttle to Surface 

1. Midcourse correction 

2. SRC goes on batteries 

3. SRC and ERV separate 

4. ERV thruster 

fires to miss Earth 

5. Nav. Update 


6. 

Aerocapture 6. 

Insertion 
Bums, (2 Stages) 

6. 

Aerocapture 6. 

Insertion 
Bums, (2 Stages) 

6. 

Entry 

7. 

Perigee Raise 7. 

Despin 

7. 

Perigee Raise 7. 

Despin 

7. 

Shroud Release 

8. 

Shuttle Launch 
with OMV and 
canister pallet (4 bums) 


8. 

Shuttle Launch 
with canister 
pallet (4 bums) 


8. 

Drogue 

Deployment 

9. 

Shuttle Rendez. 
with station HO bums) 


9. 

Shuttle rendez. 
with SRC HO bums) 


9. 

Main Chute 
Deployment 

Air Snatch 

10. 

Shuttle prox. ops. 


10. 

RMS grapples SRC 


10. 

11. 

Canister pallet and 
OMV placed on truss 


11. 

SRC placed in 
SRC canister 


11. 

SRC placed in 
SRC canister 

12. 

OMV Deploved 


12. 

SCA removed from SRC_ 


12. 

SCA removed 

13. 

OMV Rendezvous 
with SRC (10 bums) 


13. 

SCA placed in 
SCA canister 


13. 

from SRC 
SCA placed in 
SCA canister 

14. 

OMV prox. ops./ 


14. 

Shuttle deorbit 


14. 

Aircraft lands 


docks with SRC 







15. 

OMV/SRC rendez. 


15. 

Shuttle lands 





with Sta.(10 bums) 


16. OMV/SRC prox. ops. ^ 

1 7. OMV/SRC placed on truss > 

18. SRC placed in SRC canis. ^ 

1 9. SCA removed from SRC > 

20. SRC placed in SRC canis. > 

21. Shuttle Launch (4 bums) > 

22. Shuttle Rendez. with Sta. (10 bums) ^ 

23. Shuttle Prox. Ops. ^ 

24. Canister pallet placed 

in payload bay ^ 

25. Shuttle deorbit ^ 

26. Shuttle lands y 

Total No. 68 69 27 28 14 

of Operations (1 bum counts as one operation) 
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5.0 Fault Trees 


The second, more comprehensive method of risk analysis used in this report involves 
constructing a logic network for a sequence of events, nominal and off-nominal, for each option. 
The events lump together into nodes or big events, the complex series of mechanical, electronic 
and software operations that take place during each event. In general, redundant ways to 
accomplish the same function are not visible in the networks. For example using multiple 
computers with voting or having ground based calculation backing up flight computers does not 
appear in on the network. Instead the redundancy is taken into account in the probability 
estimates for each event. These estimates are discussed in section 6 of this report. 

The following fault trees describe the major events and their possible results. The trees are not 
totally comprehensive. Inclusion of all possible fault paths is not possible or desirable in this 
study. Many highly improbable paths exist, that due to lack of resources or detailed knowledge 
of the systems involved are not covered. Coverage of all possible paths also leads to such a large 
tree that comprehension is difficult. 

The approach used in this analysis is to define the sequence of events that occur in both nominal 
and off-nominal mission profiles. The events are exclusively those which are directly related to 
mission loss. The issues addressed in this analysis are focused on the relative merits of the direct 
entry, aerocapture, and propulsive capture approaches and whether it is better to attempt orbital 
rendezvous with the Space Shuttle or Freedom Space Station. Given the limited resources for 
this study and the preliminary level of definition of most of the Earth return options, the analysis 
was organized to focus on the differences between scenarios. Thus the fault trees showing the 
different mission options were built from a series of common elements, wherever possible and 
reasonable. 

The fault trees are designed to show the sequence for recovery of a single SRC. The sequence 
for recovery for a second SRC will vary considerably depending on the spacing between the two 
SRC’s in terms of time of arrival at Earth orbital altitude and orbital phasing with respect to each 
other and the Freedom Space Station. Only the direct entry approach is insensitive to the SRC 
relative timing, assuming that the two missions a separated by enough time for the air snatch and 
ground forces to redeploy. 

Figure 5.0-1 shows how the probabilities are accounted for. Following each event are up to three 
paths, each with two probability numbers. The upper number is the probability that this partic- 
ular result, rather than the other one or two listed, will occur. Adding up all the upper numbers 
after a given event should give 1.0. The lower numbers are the overall probabilities that this 
particular event will occur in the whole tree. They are the upper numbers for each line, multi- 
plied all together, back to the start of the tree. Adding up all the lower numbers for the final 
events in each sequence gives 1.0. 

Figures 5.1-1, 5.2-1, 5.3-1, etc. show the fault trees for the various options. Following each fault 
tree is a table, Tables 5.1-1, 5.2-1, etc. Each table shows the final probabilities of all the 
different paths through a tree, grouped such that the significant paths are easy to identify. 
Following these tables are another set of tables, Tables 5.1-2, 5.2-2, etc. These tables show the 
Lotus 1-2-3 spreadsheet calculations used to calculate the probabilities. Each row is a path 
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through the tree. All the numbers in the row are multiplied together to give the final probability 
for that path. Events which do not occur in that particular path are represented with a 1.0 in the 
string of numbers multiplied together. 
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Figure 5.0-1, Explanation of Fault Tree Events 
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Figure 5.1-1, Direct Entry Fault Tree 
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Table 5.1-1, Direct Entry Fault Tree Path Probabilities 
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Figure 5.1-2, Direct Entry Fault Tree Calculations 
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5.2 Aerocapture to Freedom Space Station with Processing, Orbiter Return 

The tree for Aerocapture with Freedom Space Station Processing is shown in Figure 5.2-1. It is 
the most complex of the mission scenarios with 73 individual paths. Many of the major branch- 
es of this scenario are associated with the consequences of slow response of the OMV. The 
event referred to as OMV deployment includes the complete sequence which will put an OMV 
on the Station. The current OMV (User’s Guide, 1987) and Freedom Space Station (SSP 30256) 
baseline do not maintain an OMV permanently at the Freedom Space Station. Thus OMV 
deployment includes the launch of the OMV in the Shuttle. Because the SRC cannot maintain 
thermal control of the sample beyond the life of the power system, currently defined as batteries 
rated at 90 day lifetime, hiatus in Shuttle launches as occurred after the 51-L accident will result 
in loss of thermal control of the sample. A similar series of adverse consequences result if the 
OMV has an on-oibit failure and cannot retrieve the SRC. If the retrieval by the OMV is very 
slow, the SRC orbit will decay and the SRC will reenter the atmosphere without control, 
resulting in complete mission loss. 

The sequence for recovery of a second aerocaptured SRC to the Freedom Space Station may 
require refueling or replacing a propulsion module in the OMV on-orbit. 
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Figure 5.2-1, Aerocapture to Freedom Space Station Fault Tree 
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Table 5.2-1, Aerocapture to Freedom Space Station Fault Tree Path Probabilities 
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Table 5.2-1, Aerocapture to Freedom Space Station Fault Tree Path Probabilities, Continued 
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Table 5.2-2, Aerocapture to Freedom Space Station Fault Tree Calculations 
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13 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.001 

0.94 

0.98 

1 0.9999 

14 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

1 0.99 

1 

1 

l 

1 

1 

1 

1 

0.999 

0.999 

1 

1 

0.999 

0.94 

0.01 

1 0.9999 

15 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

0.999 

0.001 

1 

0.99 

0.999 

0.94 

0.01 

1 0.9999 

16 

0.99 

l 0.9999 

1 

1 

1 

1 

1 0.9996 

1 0.99 

1 

l 

1 

1 

1 

1 

1 

0.999 

0.001 

1 

0.01 

0.999 

0.94 

0.01 

1 0.9999 

17 

0.99 

1 0.9999 

1 

1 

1 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

I 

0.001 

1 

0.95 

I 

0.999 

0.94 

0.01 

1 0.9999 

ia 

0.99 

1 0.9999 

1 

1 

1 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

l 

1 

1 

0.001 

1 

0.95 

1 

0.999 

0.94 

0.01 

1 0.9999 

19 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

I 0.99 

1 

1 

1 

1 

1 

1 

1 

0.001 

1 

0.05 

1 

0.999 

0.94 

0.01 

1 0.9999 

20 

0.99 

1 0.9999 

1 

l 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.001 

0.94 

0.01 

1 0.9999 

21 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.94 

0.01 

1 0.9999 

22 

0.99 

l 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.94 

0.01 

1 0.9999 

23 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.94 

0.01 

1 0.9999 

24 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 0.99 

1 

1 

t 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.94 

0.01 

l 0.9399 

1 25 

0.99 

0.25 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.94 

0.01 

1 0.9999 

26 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

t 0.99 

1 

1 

1 

1 

1 

1 

1 

0.999 

0.999 

1 

l 

0.999 

0.05 

0.99 

1 0.9999 

27 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

0.999 

0.001 

1 

0.99 

0.999 

0.05 

0.99 

1 0.9999 

28 

0.99 

l 0.9999 

t 

1 

1 

1 

1 0.9996 

1 0.99 

1 

l 

1 

1 

1 

1 

1 

0.999 

0.001 

1 

0.01 

0.999 

0.05 

0.99 

1 0.9999 

29 

0.99 

1 0.9999 

1 

1 

1 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

0.001 

1 

0.95 

1 

0.999 

0.05 

0.99 

1 0.9999 

30 

0.99 

I 0.9939 

l 

1 

1 

0.5 

1 0.9396 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

0.001 

1 

0.95 

1 

0.999 

0.05 

0.99 

1 0.9999 

31 

0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

1 

0.001 

1 

0.05 

1 

0.999 

0.05 

0.99 

1 1 

32 

0.99 

1 0.9999 

l 

1 

1 

1 

1 0.9996 

1 0.99 

1 

1 

l 

1 

1 

1 

i 

1 

1 

1 

1 

0.001 

0.05 

0.99 

1 1 

33 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.05 

0.01 

1 0.9999 

34 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

l 

l 

1 

1 

1 

t 

1 

0.05 

0.01 

1 0.9999 

35 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.05 

0.01 

1 0.9999 

36 

0.99 

0.75 0.9999 

1 

0.05 

I 

1 

1 0.9396 

1 0.99 

1 

l 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.05 

0.01 

1 0.9399 

37 

0.99 

0.25 0.9999 

1 

0.05 

1 

1 

1 0.S9S6 

1 0.99 

1 

1 

1 

1 

1 

1 

i 

1 

1 

1 


1 

0.05 

0.01 

1 0.9999 

38 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

t 0.9996 

1 0.99 

1 

1 

1 

l 

1 

1 

1 

1 

1 

1 

I 

l 

0.01 

1 

l 0.9999 

39 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.01 

1 

1 0.9999 

40 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 

1 0.9936 

1 0.99 

1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.01 

1 

1 0.9999 

41 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.01 

1 

1 0.9999 

42 

0.99 

0.25 0.9999 

l 

0.05 

1 

1 

1 0.S996 

1 0.99 

1 

1 

1 

l 

1 

1 

l 

1 

1 

1 

1 

1 

0.01 

l 

1 0.9999 

43 

0.99 

1 0.9999 

I 

0.95 

0.7 

0.5 

1 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

i 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 

44 

0.99 

1 0.9399 

1 

0.95 

0.7 

0.5 

I 0.9996 

1 0.99 

1 

1 

1 

1 

1 

1 

l 

l 

l 

1 

1 

1 

1 

1 

1 0.0001 


28 


29 
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Table 5.2-2, Aerocapture to Freedom Space Station Fault Tree Calculations, Continued 



Event 

-> Hid C. 

Brk-up Batt. 

ERV 

U. Entry No Ch. 

Sr ch 

Sr ch ERV 

Entry 

Aero- 

Reave 

Drgue 

Hains 




On 

Burn 

Low A. 

Icpact No Zn.in In, Sep. 

Direct 

Captr Covr 

Deply 

Deply 


Kef. 

6.1 

6.2 6.3 

6.4 

6.5 

6.6 

6.7 

6.7 6.B 

6.9 

6.10 

6.11 

6.12 

6.13 


Noun. 0.99 

0.75 0.9999 

0.9 

0.95 

0.3 

0.5 0.9999 0.9996 

0.99 

0.99 0.9996 0.9999 0.9999 


Alt. 

1 0.0001 

0.25 IE-08 

0.1 

0.05 

0.7 

0.5 

IE-05 0.0004 

0.003 

0.005 0.0004 

1E-0B 

IE-08 


Alt. 

2 0.0099 

0 0 

0 

0 

0 

0 

0 0 

0.007 

0.005 

0 

0 

0 


Chk Sua 1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

Path 1 

Event 

» -> 1 

1 2 

3 

4 

5 

6 

7 8 

9 

10 

It 

12 

13 

45 


0.99 

1 0.9999 

1 

0.95 

0.3 

1 

1 0.9996 

l 

0.99 

1 

1 

1 

46 


0.99 

0.75 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 

0.99 

1 

1 

1 

47 


0.99 

0.25 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 

0.99 

1 

1 

1 

48 


0.99 

1 0.9999 

1 

1 

1 

1 

1 0.9996 

1 

0.005 

1 

1 

1 

49 


0.99 

1 0.9999 

1 

0,95 

0.7 

0.5 

1 0.9996 

1 

0.005 

1 

1 

1 

50 


0.99 

1 0.9999 

I 

0.95 

0.7 

0.5 

1 0.9996 

1 

0.005 

1 

1 

1 

51 


0.99 

1 0.9999 

1 

0.95 

0.3 

1 

1 0.9996 

1 

0.005 

1 

l 

1 

52 


0.99 

0.75 0.9999 

1 

0.05 

1 

l 

1 0.9996 

1 

0.005 

1 

1 

1 

53 


0.99 

0.25 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 

0.005 

1 

1 

1 

54 


0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 

0.005 

l 

1 

1 

55 


0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 

1 0.9996 

1 

0.005 

1 

1 

1 

56 


0.99 

1 0.9999 

1 

0.95 

0.3 

1 

1 0.9996 

l 

0.005 

1 

1 

1 

57 


0.99 

0.75 0.9999 

1 

0.05 

1 

1 

1 0.9996 

1 

0.005 

1 

l 

1 

58 


0.99 

0.25 0.9999 

1 

0.05 

l 

1 

1 0.9996 

1 

0.005 

1 

1 

l 

59 


0.99 

1 0.9999 

0.9 

1 

1 

1 

1 0.0004 

1 

1 

1 

1 

1 

60 


0.99 

l 0.9999 

0.1 

0.95 

0.7 

0.5 

1 0.0004 

1 

1 

1 

1 

I 

61 


0.99 

1 0.9999 

0.1 

0.95 

0.7 

0.5 

1 0.0004 

1 

1 

1 

1 

1 

62 


0.99 

l 0.9999 

0.1 

0.95 

0.3 

1 

1 0.0004 

l 

1 

1 

l 

1 

63 


0.99 

0.75 0.9999 

0.1 

0.05 

1 

1 

1 0.0004 

1 

1 

1 

1 

1 

64 


0.99 

0.25 0.9999 

0.1 

0.05 

1 

1 

1 0.0004 

1 

1 

1 

1 

1 

65 


0.99 

1 1E-0B 

0.9 

1 

1 

1 

1 1 

1 

1 

1 

l 

1 

66 


0.99 

1 IE-08 

0.1 

0.95 

0.7 

0.5 

1 1 

1 

1 

1 

l 

1 

67 


0.99 

1 IE-08 

0.1 

0.95 

0.7 

0.5 

1 1 

1 

1 

1 

1 

1 

68 


0.99 

1 IE-08 

0.1 

0.95 

0.3 

1 

1 1 

l 

1 

1 

1 

1 

69 


0.99 

0.75 IE-08 

0.1 

0.05 

1 

1 

1 1 

1 

1 

1 

1 

1 

70 


0.99 

0.25 IE-08 

0.1 

0.05 

1 

l 

1 1 

1 

1 

1 

1 

1 

71 


0.0001 

0.75 1 

1 

1 

1 

1 

1 1 

l 

1 

1 

1 

1 

72 


0.0001 

0,25 1 

1 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 

73 


0.0099 

1 1 

I 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 


Totals = 


Air 

Aircft Con.Brk 6rnd 

Orb. 

Orb. 

Orb.Ent Pallet Sp Sta OHV 

OHV 

SCA Can Perige IstEQI 2ndE01 Despin 

Snatch Landng Ac ft Cr Rspn 

Entry 

lands 

Brkup 

Brkup 

Proc. 

Deplyd Rcvry lapact Raise 

Burn 

Burn 


6.14 

6.15 

6.16 

6.17 

6.18 

6.19 

6.20 

6.21 

6.22 

6.23 

6.24 

6.25 6.26 

6.27 

6.2B 

6.29 

0.97 0.9999 

0.99 

0.9 

0.999 

0.999 

0.95 

0.99 

0.995 

0.94 

0.98 

0.1 0.9999 0.9993 0.9991 0.9997 

0.03 

IE-06 

0.01 

0.1 

0.001 

0.001 

0.05 

0.01 

0.004 

0.05 

0.01 

0.9 0.0001 0.0007 0.0006 0.0003 

0 

0 

0 

0 

0 

0 

0 

0 

0.001 

0.01 

0.01 

0 0 

0 

0 

0 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 1.000 

1.000 

1.000 

1.000 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 26 

27 

28 

29 


0.0001 

0.0001 

0.0001 

0.9899 

0.0001 

0.0001 

0.0001 

0.0001 

0 . 000 ! 
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Table 5.2-2, Aerocapture to Freedom Space Station Fault Tree Calculations, Continued 


3 


Shut 1 e Sh.Rnd 
Ascnt LRMS C 
6.30 6.31 


0.9 0.999 11111111 

0.05 0.001 00000000 

0.05 0 0 0 0 0 0 0 0 0 100 X 

1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 Success 


Path I '30 

1 1 

2 1 

3 1 

4 l 

5 1 

6 1 

7 1 


32 33 34 35 36 


38 39 

1 1 0.8S611 


9 

10 
11 
12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 


Degraded Can. Breach Can. Breach Unsterilized Lost Sterilized Space Peraanent 

Saiple (Satple Re- (Saaple Lost Saaple Satple Lost Saaple Station Orbit 

covrd or in Destroyed) (on Earth) (in Space) (on Earth) Contaain. 
theory rcvrable) 


0.00089 

0.00043 

0.00360 

3.57E-06 

1.71E-06 

0.00918 

9.10E-Q6 

4.37E-06 

0.00306 

0.04835 

0.00005 

2.30E-05 

0.00016 

0.00326 

3.26E-05 


8.97E-06 


3.61E-08 


9.I9E-08 


0.00262 


4.B4E-07 


0.00014 


0.00279 


4.49E-05 


1.80E-07 


4.60E-07 


0.00012 


2.42E-06 


6.12E-06 


0.00012 


0.00306 


0.00016 


0.00326 


3.26E-05 


0.00043 


1.71E-06 

0.00090 


4.37E-06 

9.21E-06 


0.00035 


2.30E-05 

4.85E-05 


1.81E-05 


0.00037 
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Table 5.2-2, 

Aerocapture 

to Freedom Space Station Fault Tree Calculations, Continued 





Shut le Sh.Rnd 













Ascnt 

ms c 













6.30 

6.31 













0.9 

0.999 1 

1 

1 

1 

1 

1 

1 

1 






0.05 

0.00! 0 

0 

0 

0 

0 

0 

0 

0 






0.05 

0 0 

0 

0 

0 

0 

0 

0 

0 100 1 

Degraded Can. Breach Can. Breach Unsterilized Lost 

Sterilized 

Space 

Peraanent 


1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 Success 

Saaple (Saeple Re* (Saaple Lost Saaple Saaple 

Lost Saaple 

Station 

Orbit 











covrd or in Destroyed) (on Earth) (in Space) (on Earth) 

Contaain. 


Path 1 

*30 

31 32 

33 

34 

35 

36 

37 

38 

39 

theory rcvrable) 




45 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

2.79E-05 




46 

1 

1 1 

1 

1 

t 

l 

1 

1 

1 


3.67E-06 



47 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1.22E-06 




48 

l 

1 1 

1 

1 

1 

1 

l 

1 

1 




0.00495 

49 

1 

1 1 

1 

1 

1 

1 

1 

1 

l 

1.65E-07 




50 

1 

l 1 

1 

1 

1 

1 

1 

1 

1 

1.65E-07 




51 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1.41E-07 




52 

1 

l 1 

1 

l 

1 

1 

1 

1 

l 


1.86E-08 



53 

1 

t 1 

1 

1 

1 

1 

1 

1 

1 

6.19E-09 




54 

1 

1 1 

t 

1 

1 

l 

l 

l 

1 

0.00165 




55 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

0.00165 




56 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

0.00141 




57 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 


0.00019 



58 

1 

1 1 

l 

l 

1 

1 

l 

1 

1 

6.19E-05 




59 

1 

1 1 

1 

1 

1 

1 

t 

1 

1 

0.00036 




60 

1 

l 1 

1 

1 

1 

1 

1 

1 

1 

1.32E-05 




61 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1.32E-05 




62 

l 

1 1 

1 

1 

1 

1 

1 

1 

1 

1.13E-05 




63 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 


1.4BE-06 



64 

t 

1 1 

1 

1 

1 

1 

1 

1 

1 

4.95E-07 




65 

1 

1 1 

1 

1 

1 

1 

1 

t 

1 

8.91E-09 




66 

I 

1 1 

1 

1 

1 

1 

1 

1 

1 

3.29E-10 




67 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

3.29E-1Q 




68 

1 

1 1 

1 

l 

1 

l 

1 

l 

1 

2.82E-10 




69 

1 

1 1 

I 

1 

1 

1 

1 

1 

1 


3.7125E-11 



70 

1 

1 1 

1 

1 

1 

1 

1 

t 

1 

1.24E-U 




71 

l 

1 1 

1 

1 

1 

1 

1 

1 

1 


7.50E-05 



72 

1 

1 1 

1 

1 

l 

1 

1 

1 

1 

2.50E-Q5 




73 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

0.00990 




Totals = 









Totals 0.89611 

0.07071 0.00701 0.00038 0.00817 0.01026 

0.00145 

0.00096 

0.00495 


Check Sui = 1,0000 Totals of Canister Breached = 0.0156 
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5.3 Aerocapture to LEO, Shuttle Recovery with RMS from LEO 

The fault tree for aerocapture to a Space Shuttle has 9 fewer branches than to the Freedom Space 
Station due to the elimination of the OMV recovery phase, for a total of 64 branches. 

The recovery of a second SRC to the Space Shuttle places the most stringent demands on SRC 
orbital timing and targeting, because the Orbiter can only remain in orbit approximately 10 days. 
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Figure 5.3-1, Aerocapture to Shuttle Fault Tree 






















Table 5.3-1, Aerocapture to Shuttle Fault Tree Path Probabilities 


100 X 
Success 


Path i 

1 0.91716 

2 

3 

4 

5 

6 

7 

8 

9 

10 
11 
12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

40 

41 

42 

43 

44 

45 

46 

47 

48 

49 

50 

51 

52 


Degraded 

Saaple 


Can. Breach Can. Breach 

(Saaple Re- (Saaple 
covrd or in Destroyed) 

theory rcvrable) 


Unsterilized 
Lost Saaple 
(on Earth) 


Lost Sterilized Space 

Saaple Lost Saple Station 

(in Space) (on Earth) Contaain. 


0.00091 

0.00044 

0.00092 

9.10E-07 

4.37E-07 


9.18E-06 


9.19E-09 


4.59E-05 


0.00031 

0.03907 

3.87E-05 

1.86E-05 


0.00026 


3.91E-07 


4.60E-08 


1.15E-05 


0.00031 


1.30E-05 


0.00651 


3.26E-05 


1.12E-05 


0.00558 


2.79E-05 


1.96E-06 


4.90E-07 


0.00024 


1.22E-06 


1.30E-05 


0.00651 


3.26E-05 


0.00044 


4.37E-07 


3.45E-05 


1.86E-05 


1.47E-06 


0.00073 


3.67E-06 


1.65E-07 


1.65E-07 


1.41E-07 


1.86E-0 


6.19E-09 


0.00165 


0.00165 


0.00141 


0.00019 


6.19E-05 


0.00036 


1.32E-05 


1.32E-05 


Peraanent 

Orbit 


0.00495 
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Table 5.3-1, Aerocapture to Shuttle Fault Tree Path Probabilities, Continued 

100 Z Degraded Can. Breach Can. Breach Unsterilized Lost Sterilized Space Permanent 


Success Saaple (Saaple Re- (Saaple 

covrd or in Destroyed) 
Path t theory rcvrable) 

53 1.13E-05 

54 

55 4.95E-07 

56 

57 3.29E-10 

58 

59 2.82E-10 


60 

61 1.24E-11 

62 

63 2.50E-05 

64 

Totals = 0.91716 0.04991 0.00732 0.00039 

Check Sun = 1.0000 


Lost Saaple Saaple Lost Saple Station Orbit 
(on Earth) (in Space) (on Earth) Contaain. 

1.48E-06 

8.91E-09 

3.29E-10 

3.71E-11 

7.50E-05 

0.00990 

0.00852 0.01026 0.00149 0.00000 0.00495 

Totals of Canister Breached = 0.0162 
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Table 5.3-2, Aerocapture to Shuttle Fault Tree Calculations 



Event-) Hid C. 

Brk-up Batt. 
On 

ERV 

Burn 

U. Entry No Ch. Srch Srch ERV 
Lou A. inpact No Zn.in Zn. Sep. 

Entry 

Direct 

Aero- Reave 
Captr Covr 

Drgue 

Deply 

Hains 

Deply 

Air tarcft Con.Brk Sind 
Snatch Landng Ac ft Cr Rspn 

Orb. 

Entry 

Drb. 

Lands 

Orb.Ent Pallet Sp Sta QMV OHV SCA Can Perige IstEOl 2ndEDl Despin 

Brkup Brkup Proc. Deplyd Rcvry Inpact Raise Burn Burn 


Ref. 6.1 

6.2 6.3 

6.4 

6.5 

6.6 

6.7 6.7 6.8 

6.9 

6.10 6.11 

6.12 

6.13 

6.14 6.15 

6.16 

6.17 

6. IB 

6.19 

6.20 

6.21 

6.22 

6.23 

6.24 

6.25 6.26 6.27 6.28 6.29 


Noain. 0.99 

0.75 0.9999 

0.9 

0.95 

0.3 

0.5 0.9999 0.9996 

0.99 

0.99 0.9996 0.9999 0.9999 

0.97 0.9999 

0.99 

0.9 

0.999 

0.999 

0.95 

0.99 

0.995 

0.94 

0.98 

0.1 0.9999 0.9993 0.9994 0.9997 


Alt. 1 0.0001 

0.25 1E-0B 

0.1 

0.05 

0.7 

0.5 IE-05 0.0004 

0.003 

0.005 0.0004 

IE-08 

IE-08 

0.03 IE-06 

0.01 

0.1 

0.001 

0.001 

0.05 

0.01 

0.004 

0.05 

0.01 

0.9 0.0001 0.0007 0.0006 0.0003 


Alt. 2 0.0099 

0 0 

0 

0 

0 

0 0 0 

0.007 

0.005 0 

0 

0 

0 0 

0 

0 

0 

0 

0 

0 

0.001 

0.01 

0.01 

0 0 0 0 0 


Chk Sui 1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 1.000 1.000 

1.000 

1.000 1.000 

1.000 

1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 1.000 1.000 1.000 1.000 

t 

Event » -> 1 

1 2 

3 

4 

5 

6 7 8 

9 

10 11 

12 

13 

14 15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 26 27 28 29 

1 

0.99 

l 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.999 

1 

l 

1 

1 

1 

1 0.9999 1 1 1 

2 

0.99 

1 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

1 

l 

1 1 

1 

1 

0.999 

0.001 

1 

0.99 

1 

1 

1 

1 0.9999 1 1 1 

3 

0.99 

1 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.001 

1 

0.01 

1 

1 

1 

1 0.9999 1 1 1 

4 

0.99 

l 0.9999 

l 

1 

1 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.001 

1 

0.95 

1 

1 

1 

l 

1 0.9999 1 1 1 

5 

0.99 

1 0.9999 

1 

1 

1 

0.5 1 0.9996 

I 

0.99 1 

1 

1 

1 1 

1 

1 

0.001 

1 

0.95 

1 

1 

1 

1 

1 0.9999 1 1 1 

6 

0.99 

l 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

t 

1 

1 1 

1 

1 

0.001 

1 

0.05 

1 

1 

1 

1 

l 0.9999 1 1 1 

7 

0.99 

1 0.9999 

1 

i 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.999 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

8 

0.99 

1 0.9999 

1 

l 

l 

l 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.001 

1 

0.99 

1 

l 

1 

1 0.9999 1 1 1 

9 

0.99 

1 0.9999 

1 

l 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.001 

1 

0.01 

1 

1 

1 

1 0.9999 1 1 1 

io 

0.99 

1 0.9999 

1 

i 

1 

0.5 1 0.9996 

1 

0.99 l 

1 

l 

1 1 

1 

1 

0.001 

l 

0.95 

l 

1 

1 

l 

1 0.9999 1 1 1 

u 

0.99 

1 0.9999 

1 

l 

1 

0.5 1 0.9996 

1 

0.99 l 

1 

1 

1 1 

1 

1 

0.001 

1 

0.95 

1 

1 

1 

1 

1 0.9999 1 1 1 

12 

0.99 

1 0.9999 

1 

i 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

l 

1 

0.001 

l 

0.05 

1 

1 

1 

1 

1 0.9999 1 1 1 

13 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

t 

1 0.9999 1 1 1 

14 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

15 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

16 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

l 

1 

l 

1 

1 

1 

l 

l 

1 0.9999 1 1 1 

17 

0.99 

0.25 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

18 

0.99 

1 0.9999 

1 

1 

l 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.999 

1 

l 

1 

1 

1 

l 0.9999 1 1 1 

19 

0.99 

1 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.001 

1 

0.99 

1 

1 

1 

1 0.9999 1 1 1 

20 

0.99 

1 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.999 

0.001 

1 

0.01 

1 

1 

1 

1 0.9999 1 1 1 

21 

0.99 

1 0.9999 

1 

1 

1 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.001 

1 

0.95 

1 

l 

1 

1 

1 0.9999 l 1 1 

22 

0.99 

1 0.9999 

1 

1 

l 

0.5 1 0.9996 

l 

0.99 l 

l 

1 

1 1 

1 

1 

0.001 

1 

0.95 

1 

1 

1 

1 

1 0.9999 1 1 1 

23 

0.99 

1 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

0.001 

1 

0.05 

1 

1 

1 

1 

11111 

24 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

l 1 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 0.9999 1 1 l 

25 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

26 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

27 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

28 

0.99 

0.25 0.9999 

1 

0.05 

l 

1 1 0.9996 

l 

0,99 1 

1 

1 

1 1 

l 

1 

l 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

29 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

30 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

1 0.9999 1 1 l 

31 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

l 

1 

i 

L 

l 

t 0.9999 1 1 1 

32 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

t 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

33 

0.99 

0.25 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 l 

34 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

l 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 

35 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 

36 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 

37 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 

38 

0.99 

0.25 0.9999 

1 

0.05 

l 

1 1 0.9996 

1 

0.99 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 

39 

0.99 

1 0.9999 

1 

1 

1 

1 1 0.9996 

1 

0.005 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.9999 1 1 1 

40 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.005 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

l 

1 

1 0.0001 1 1 1 

41 

0.99 

1 0.9999 

1 

0.95 

0.7 

0.5 1 0.9996 

1 

0.005 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

1 0.0001 1 1 1 

42 

0.99 

1 0.9999 

1 

0.95 

0.3 

1 1 0.9996 

1 

0.005 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 

43 

0.99 

0.75 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.005 1 

1 

1 

1 1 

1 

1 

1 

1 

I 

1 

1 

1 

1 

1 0.0001 1 1 1 

44 

0.99 

0.25 0.9999 

1 

0.05 

1 

1 1 0.9996 

1 

0.005 1 

1 

1 

1 1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 0.0001 1 1 1 
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Table 5.3-2, Aerocapture to Shuttle Fault Tree Calculations, Continued 






r- 

in 



3 


Table 5.3-2, Aerocapture to Shuttle Fault Tree Calculations, Continued 



Shutle Sh.Rnd 


Qrbiter 











Ascnt 

wits c 


Handel ing 











6.30 

6.31 


6.32 











0.94 

0.999 

1 

1 0.999 

1 

1 

1 

1 

1 






0.04 

0.001 

0 

0 0.001 

0 

0 

0 

0 

0 






0.02 

0 

0 

0 0 

0 

0 

0 

0 

0 

100 Z Degraded 

Can. Breach Can. Breach Unsterilized Lost 

Sterilized Space 

Peraanent 


1.000 

1.000 

1.000 

1.000 1.000 1.000 

1.000 

1.000 

1.000 

1.000 

Success Saaple 

(Saaple Re- (Saaple Lost Saaple Saaple 

Lost Saple Station 

Orbit 












covrd or in Destroyed) (on Earth) (in Space) 

(on Earth) Contaain, 


Path I 

30 

31 

32 

33 34 

35 

36 

37 

38 

39 


theory rcvrable) 



1 

0.94’ 

0.999 

1 

1 0.999 

1 

1 

1 

1 

1 

0.91716 




2 

0.94 

0.999 

1 

1 0.999 

1 

1 

1 

1 

1 

0.00091 




3 

0.94 

0.999 

1 

1 0.999 

1 

1 

1 

1 

1 


9.1BE-06 



4 

0.94 

0.999 

1 

1 0.999 

1 

1 

l 

l 

1 

0.00044 




5 

0.94 

0.999 

1 

1 0.999 

1 

1 

1 

1 

1 



0.00044 


6 

0.94 

0.999 

1 

1 0.999 

l 

1 

1 

1 

l 


4.59E-05 



7 

0.94 

0.999 

1 

1 0.001 

1 

1 

1 

1 

1 

0.00092 




a 

0.94 

0.999 

1 

1 0.001 

l 

l 

1 

1 

1 

9.10E-07 




9 

0.94 

0.999 

1 

1 0.001 

1 

1 

1 

1 

1 


9.19E-09 



10 

0.94 

0.999 

1 

1 0.001 

l 

1 

1 

1 

1 

4.37E-07 




n 

0.94 

0.999 

1 

1 0.001 

1 

1 

1 

1 

1 



4.37E-07 


12 

0.94 

0.999 

l 

1 0.001 

1 

l 

1 

1 

l 


4.60E-08 



13 

0.94 

0.001 

1 

1 1 

1 

1 

1 

1 

1 

0.00031 




14 

0.94 

0.001 

1 

1 1 

1 

1 

1 

1 

1 


0.00031 



15 

0.94 

0.001 

1 

1 1 

1 

1 

1 

1 

1 


0.00026 



16 

0.94 

0.001 

1 

1 1 

1 

l 

1 

1 

1 



3.45E-05 


17 

0.94 

0.001 

1 

1 1 

1 

1 

1 

1 

1 


1.15E-05 



18 

0.04 

0.999 

1 

1 1 

1 

1 

1 

1 

1 

0.03907 




19 

0.04 

0.999 

1 

1 1 

1 

1 

1 

1 

1 

3.87E-05 




20 

0.04 

0.999 

1 

1 1 

1 

1 

1 

1 

1 


3.91E-07 



21 

0.04 

0.999 

1 

1 1 

1 

1 

1 

1 

1 

1.86E-Q5 




22 

0.04 

0.999 

1 

1 1 

1 

1 

1 

l 

1 



1.86E-05 


23 

0.04 

0.999 

1 

1 1 

1 

1 

1 

1 

1 


1.96E-06 



24 

0.04 

0.001 

1 

1 1 

1 

1 

1 

1 

1 

1.30E-05 




25 

0.04 

0.001 

1 

1 1 

1 

1 

1 

1 

1 


1.30E-05 



26 

0.04 

0,001 

1 

1 1 

1 

1 

1 

1 

1 


1.12E-05 



27 

0.04 

0.001 

1 

1 1 

1 

1 

1 

1 

1 



1.47E-06 


28 

0.04 

0.001 

1 

1 1 

1 

1 

1 

l 

1 


4.90E-07 



29 

0.02 

1 

1 

1 1 

1 

1 

1 

1 

1 

0.00651 




30 

0.02 

1 

1 

1 1 

1 

1 

1 

1 

1 


0.00651 



31 

0.02 

1 

1 

1 1 

1 

1 

1 

1 

1 


0.00558 



32 

0.02 

1 

1 

1 1 

1 

1 

1 

1 

1 



0.00073 


33 

0.02 

1 

1 

1 1 

1 

1 

1 

1 

1 


0.00024 



34 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 

3.26E-05 




35 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 


3.26E-05 



36 

1 

1 

1 

1 1 

1 

1 

l 

1 

1 


2.79E-05 



37 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 



3.67E-06 


38 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 


1.22E-06 



39 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 




0.00495 

40 

1 

l 

1 

1 l 

1 

1 

1 

1 

1 

1.65E-07 




41 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 


1.65E-07 



42 

1 

l 

1 

1 1 

1 

1 

1 

1 

1 


1.41E-07 



43 

1 

1 

1 

1 1 

1 

1 

1 

1 

1 



1.86E-08 


44 

l 

1 

1 

1 1 

1 

l 

1 

1 

1 


6.19E-09 
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Table 5.3-2, Aerocapture to Shuttle Fault Tree Calculations, Continued 


Shutle Sh.Rnd 
Ascnt im C 
6.30 6.3! 


Qrbiter 

Handeling 

6.32 



0.94 

0.999 

1 

1 

0.999 

1 

1 

1 

1 

1 




0.04 

0.001 

0 

0 

0.001 

0 

0 

0 

0 

0 




0.02 

0 

0 

0 

0 

0 

0 

0 

0 

0 

100 1 Degraded Can. Breach Can. Breach Unsterilized Lost 

Sterilized Space Peraanent 


1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

Success Saaple (Saaple Re* (Saiple Lost Saaple Saiple 

Lost Saple Station Orbit 












covrd or in Destroyed) (on Earth) (in Space) 

(on Earth) Contaain. 

Path « 

30 

31 

32 

33 

34 

35 

36 

37 

38 

39 

theory rcvrable) 


45 


1 

1 

l 

1 

1 

1 

1 

1 

1 

0.00165 


46 

1 

1 

1 

1 

l 

1 

1 

1 

1 

1 

0.00165 


47 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.00141 


48 

1 

l 

1 

1 

1 

1 

l 

1 

1 

l 


0.00019 

49 

1 

1 

1 

1 

1 

1 

1 

1 

1 

l 

6. 19E-05 


50 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

0.00036 


51 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

I.32E-05 


52 

l 

1 

l 

1 

1 

1 

1 

l 

1 

l 

1.32E-05 


53 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1.13E-05 


54 

1 

1 

1 

l 

1 

1 

1 

1 

1 

1 


1.48E-06 

55 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

4.95E-07 


56 

t 

1 

1 

1 

1 

1 

1 

1 

l 

l 

8.9IE-09 


57 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

3.29E-10 


58 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

3.29E-10 


59 

1 

1 

1 

1 

1 

1 

l 

1 

1 

1 

2.B2E-10 


60 

1 

i 

1 

1 

1 

1 

1 

1 

1 

1 


3.71E-1I 

6! 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1.24E-11 


62 

1 

1 

1 

1 

l 

l 

1 

1 

1 

1 


7.50E-05 

63 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

2.50E-05 


64 

1 

1 

1 

1 

1 

1 

1 

l 

1 

1 

0.00990 


Totals = 











0.91716 0.04991 0.00732 0.00039 0.00852 0.01026 

0.00149 0.00000 0.00495 












Check Sue 5 1.0000 Totals of Canister Breached = 0.0162 
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5.4 Propulsive Capture to Freedom Space Station with Repackaging and Orbiter Return 

The mission sequence for propulsive capture to the Freedom Space Station is significantly 
simpler than aerocapture, with 43 paths (Figure 5.4-1). However, all of the branches associated 
with the OMV deployment and recovery are identical to those of aerocapture, resulting in similar 
overall probabilities. 

The sequence for recovery of a second propulsively captured SRC to the Freedom Space Station 
may require refueling the OMV on-orbit. 


60 



Nominal 


at 


o 

3? 

iO 

c: 


I 


e 

r* ^ 

3 a 


'*5 

>4 

1 


* 

& 




36 


37 


r° 



Figure 5.4-1, Propulsive Capture to Freedom Space Station Fault Tree 
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Table 5.4-1, Propulsive Capture to Freedom Space Station Fault Tree Path Probabilities 


Path i 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 
11 
12 

13 

14 

15 

16 

17 

18 


100 X 
Success 


0.90330 


Degraded Can. Breach Can. Breach Unsterilized 
Saaple (Saaple Re- (Saaple Lost Saaple 
covrd or in Destroyed) 
theory rcvrable) 


Lost Sterilized 

Saaple Lost Saple 

(on Earth) (in Space) (on Earth) 


0.00090 

0.00043 


0.00363 

3.60E-06 

1.73E-06 


0.00926 

9.18E-06 

4.41E-06 


9.05E-06 


4.53E-05 


3.64E-08 


1.82E-07 


9.27E-08 


0.00043 


1.73E-06 


4.41E-06 


19 



4.64E-07 


20 





21 




0.00697 

22 



0.00232 


23 

0.04876 




24 

4.83E-05 




25 


4.88E-07 



26 

2.32E-05 




27 




2.32E-05 

28 


2.44E-06 



29 





30 




0.00037 

31 



0.00012 


32 




0.00741 

33 



0.00247 


34 




0.00022 

35 



7.41E-05 


36 




0.00045 

37 



0.00015 


38 



0.00069 


39 



0.00040 


40 



9.90E-09 


41 




0.00375 

42 



0.00125 


43 



0.00500 


Is = 

0.90380 0.06307 

0.00001 

0.00643 0.00000 0.00609 

0.01962 


Check Sun = 1 


Totals of Canister Breached = 

0.0064 


Space 

Station 

Contaain. 


0.00091 


9.29E-06 


4.89E-05 


0.00097 
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Table 5.4-2, Propulsive Capture to Freedom Space Shuttle Fault Tree Calculations 


i 


Event-) Hid C. 

Brk-up Batt. 
On 

ERV 

Burn 

U. Entry No Ch. Srch Srch ERV 
Low A. l.pict No Zn.in Zn. Sep. 

Entry 

Direct 

Aero- Reive 
Captr Covr 

Drgue 

Oeply 

Mains 

Oeply 

Air Aircft Con.Brk Grnd 
Snatch landng Ac ft Cr Rspn 

Orb. 

Entry 

Orb. 

Lands 

Qrb.Ent Pallet 
Brkup Brkup 

Sp St a QhV QHV SCA Can Perige IstEQI 2ndE01 Despin 

Proc. Oepiyd Rcvry fapact Raise Burn Burn 

Ref. 

6.1 

6.2 6.3 

6.4 

6.5 

6.6 

6.7 

6.7 

6.8 

6.9 

6.10 6.11 


6.12 

6.13 

6.14 

6.15 

6.16 

6.17 

6.18 

6.19 

6.20 

6.21 

6.22 

6.23 

6.24 

6.25 

6.26 6.27 6.28 6.29 

Ncain. 

0.99 

0.75 0.9999 

0.9 

0.95 

0.3 

0.5 0.9999 0.9996 

0.99 

0.99 0.9996 0.9999 0.9999 

0.97 0.9999 

0.99 

0.9 

0.999 

0.999 

0.95 

0.93 

0.995 

0.94 

0.98 

0.1 0.9993 0.9993 0.9934 0.9997 

Alt. 1 

0.005 

0.25 IE-08 

0.1 

0.05 

0.7 

0.5 

IE-05 0.0004 

0.003 

0.005 0.0004 

iE-oa 

IE-08 

0.03 

IE-06 

0.01 

0.1 

0.001 

0.001 

0.05 

0.01 

0.001 

0.05 

0.01 

0.9 0.0001 0.0007 0.0006 0.0003 

Alt. 2 

0.005 

0 0 

0 

0 

0 

0 


0 0 

0.007 

0.005 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0.004 

0.01 

0.01 

0 

0 0 0 0 

Chk Sue 1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 

1.000 1.000 

1.000 

1.000 1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 1.000 1.000 1.000 

Path 1 Event « 

-> 1 

i 2 

3 

4 

5 

6 


7 e 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 27 28 29 

1 

0.99 

I 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.999 

1 

1 

0.995 

0.94 

0.9B 

1 

1 0.9993 0.9994 0.9997 

2 

0.99 

1 0.9999 

1 

1 

1 

l 


1 0.9996 

1 

1 

1 


l 

1 

1 

1 


0.999 

0.001 

1 

0.99 

0.995 

0.94 

0.98 

1 

1 0.9993 0.9994 0.9997 

3 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.001 

1 

0.01 

0.995 

0.94 

0.98 

i 

1 0.9993 0.9994 0.9997 

;♦ 

0.99 

1 0.9999 

l 

1 

l 

0.5 


1 0.9996 

1 

1 

l 


1 

l 

1 

1 


0.001 

1 

0.95 

1 

0.995 

0.94 

0.98 

1 

1 0.9993 0.9994 0.9997 

5 

0.99 

1 0.9999 

1 

1 

1 

0.5 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.95 

1 

0.995 

0.94 

0.9B 

1 

1 0.9993 0.9994 0.9997 

6 

0.99 

l 0.9999 

1 

l 

1 

1 


l 0.9996 

l 

l 

1 


1 

1 

1 

1 


0.001 

1 

0.05 

1 

0.995 

0.94 

0.98 

1 

1 0.9993 0.9994 0.9997 

7 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.999 

1 

1 

0.004 

0.94 

0.98 

1 

1 0.9993 0.9994 0.9997 

8 

0.99 

1 0.9999 

1 

1 

l 

l 


1 0.9996 

1 

1 

1 


1 

l 

1 

1 


0.999 

0.001 

1 

0.99 

0,004 

0.94 

0.98 

l 

1 0.9993 0.9994 0.9997 

9 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.001 

1 

0.01 

0.004 

0.94 

0.98 

1 

1 0.9993 0.9994 0.9997 

10 

0.99 

I 0.9999 

I 

1 

1 

0.5 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.95 

1 

0.004 

0.94 

0.98 

l 

1 0.9993 0.9994 0.9997 

11 

0.99 

1 0.9999 

l 

1 

1 

0.5 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.95 

1 

0.004 

0.94 

0.3B 

1 

1 0.9993 0.9994 0.9997 

12 

0.99 

1 0.9999 

1 

l 

1 

l 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.05 

1 

0.004 

0.94 

0.98 

1 

l 0.9993 0.9994 0.9997 

13 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

0.001 

0.94 

0.98 

1 

1 0.9993 0.9994 0.9997 

14 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

l 

1 

1 


1 

1 

l 

1 


0.999 

0.999 

1 

1 

0.999 

0.94 

0.01 

1 

1 0.9993 0.9994 0.9997 

IS 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.001 

1 

0.99 

0.999 

0.94 

0.01 

1 

1 0.9993 0.9994 0.9997 

16 

0.99 

1 0.9999 

1 

I 

1 

1 


1 0.9996 

1 

l 

1 


1 

l 

1 

l 


0.999 

0.001 

1 

0.01 

0.999 

0.94 

0.01 

1 

l 0.9993 0.9994 0.9997 

17 

0.99 

1 0.9999 

1 

1 

1 

0.5 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.95 

1 

0.999 

0.94 

0.01 

1 

1 0.9993 0.9994 0.9997 

18 

0.99 

1 0.9999 

1 

1 

t 

0.5 


t 0.9996 

l 

1 

1 


1 

1 

l 

1 


0.001 

1 

0.95 

l 

0.999 

0.94 

0.01 

l 

1 0.9993 0.9994 0.9997 

19 

0.99 

1 0.9999 

1 

1 

1 

l 


1 0.9996 

1 

1 

1 


1 

1 

1 

l 


0.001 

1 

0.05 

1 

0.999 

0.94 

0.01 

1 

1 0.9993 0.9994 0.9997 

20 

0.99 

1 0.9999 

1 

1 

l 

1 


1 0.9996 

l 

1 

1 


1 

l 

1 

l 


1 

1 

1 

1 

0.001 

0.94 

0.01 

1 

l 0.9993 0.9994 0.9997 

21 

0.99 

0.75 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

0.94 

0.01 

1 

1 0.9993 0.9994 0.9997 

22 

0.99 

0.25 0.9999 

1 

1 

1 

l 


1 0.9996 

1 

1 

1 


1 

1 

l 

1 


l 

l 

1 

l 

1 

0.94 

0.01 

1 

1 0.9993 0.9994 0.9997 

23 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.999 

1 

1 

0.999 

0.05 

0.99 

1 

1 0.9993 0.9994 0.9997 

24 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.001 

1 

0.99 

0.999 

0.05 

0.93 

1 

1 0.9993 0.9994 0.9937 

25 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.999 

0.001 

1 

0.01 

0.999 

0.05 

0.93 

1 

1 0.9993 0.9994 0.9997 

26 

0.99 

1 0.9999 

1 

l 

1 

0,5 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.95 

l 

0.939 

0.05 

0.33 

1 

1 0.9993 0.3994 0.9997 

27 

0.99 

1 0.9999 

1 

1 

1 

0.5 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


0.001 

1 

0.95 

l 

0.999 

0.05 

0.99 

1 

1 0.9993 0.9994 0.9997 

28 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


l 

1 

1 

1 


0.001 

1 

0.05 

1 

0.939 

0,05 

0.99 

1 

1 0.9993 0.9994 0.9997 

29 

0.99 

1 0.9999 

l 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

0.001 

0.05 

0.99 

1 

1 0.9993 0.9994 0.9997 

30 

0.99 

0.75 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

l 

1 


1 

1 

l 

l 

1 

0.05 

0.01 

1 

1 0.9993 0.3994 0.9997 

31 

0.99 

0.25 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

0.05 

0.01 

1 

1 0.9993 0.9994 0.9997 

32 

0.99 

0.75 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


l 

1 

l 

1 


1 

1 

1 

1 

1 

0.01 

1 

1 

1 0.9993 0.9994 0.9997 

33 

0.99 

0.25 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

0.01 

1 

1 

1 0.9993 0.9994 0.9997 

34 

0.99 

0.75 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

l 

1 

1 


1 

1 

1 

1 

1 

1 

1 

1 

1 0.9993 0.9994 0.0003 

35 

0.99 

0.25 0.9999 

1 

1 

1 

1 


l 0,9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

1 

1 

1 

1 0.9993 0.9994 0.0003 

36 

0.99 

0.75 0.9999 

1 

1 

l 

1 


1 0.9996 

1 

l 

l 


1 

1 

1 

1 


1 

1 

l 

l 

1 

1 

l 

1 

1 0.9993 0.0006 1 

37 

0.99 

0.25 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

l 

1 

1 

1 

1 

1 

1 

1 0.9993 0.0006 1 

38 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.9996 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

1 

1 

l 

1 0.0007 1 1 

39 

0.99 

1 0.9999 

1 

1 

1 

1 


1 0.0004 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

1 

1 

1 

1111 

40 

0.99 

1 IE-08 

1 

1 

1 

l 


1 l 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

l 

1 

1 

1 

1111 

41 

0.005 

0.75 1 

1 

1 

1 

1 


1 1 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

1 

1 

1 

1111 

42 

0.005 

0.25 1 

1 

1 

1 

l 


1 1 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

1 

l 

1 

1111 

43 

Totals s 

0.005 

1 1 

1 

1 

1 

1 


1 1 

1 

1 

1 


1 

1 

1 

1 


1 

1 

1 

1 

1 

1 

I 

1 

1111 


4 
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Table 5.4-2, Propulsive Capture to Freedom Space Shuttle Fault Tree Calculations, Continued 

Shut I e Sh.flnd 
Ascot IRKS C 
8.30 8.31 



0.94 

0.999 

1 

1 

1 

l 

1 

1 

1 


0.04 

0.001 

0 

0 

0 

0 

0 

0 

0 


0.02 

0 

0 

0 

0 

0 

0 

0 

0 


1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

1.000 

Path 1 

30 

31 

32 

33 

34 

35 

36 

37 

38 

1 

1 

1 
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6.0 Probability Estimates for Failures 


In section 5, fault trees are presented for four mission options. Each one of these fault trees has a 
series of branch points or events. In all the trees, there are only a limited number of events. This 
section discusses each of these events in some detail, and explains the rational for the numbers 
chosen. 

6.1 Event: Last Midcourse Correction - This is the last in what may be a series of mid- 

course corrections from Mars to Earth. It is assumed that each correction targets 
have been proposed in which the ERV/SRC is targeted to miss Earth and only 
after separation from the ERV does the SRC make a bum that will result in the 
proper entry trajectory. This idea reduces the risk of canister breach some small 
amount since failures during the last midcourse, ERV/SRC separation, and initial 
SRC operation cannot result in breach, only sample loss. However, this scheme 
may cost weight since the SRC gets power from the ERV and it is desirable to 
keep the two vehicles together for as long as possible to reduce the mass of the 
SRC. The closer the last midcourse is made to Earth, the more propellant is used. 

Possible 

Results: Nominal Trajectory (aligned for proper Earth entry) or sufficiently normal such 
that the normal mission sequence can be followed, resulting in chute opening for 
direct entry, no break-up or bum-up for aerocapture and no atmospheric entry for 
propulsive capture. 

High Off-Nominal Trajectory resulting in a steeper than normal entry and high 
g’s. For the direct entry case, high g capsule breakup results. Trajectories 
resulting in anything less than capsule breakup are accounted for in the Nominal 
path for direct entry. 

For the aerocapture case, this would be an entry steep enough to result in break- 
up. An entry from which an exit from the atmosphere is not possible, but during 
which the SRC remains intact is handled along the nominal path. 

For propulsive capture, this case includes any off-nominal trajectory resulting in 
significant atmospheric entry and bum-up in a few orbits or less. 

Miss Earth - The trajectory either misses Earth entirely or is so shallow that a 
skip occurs. The vehicle continues on into interplanetary space and the probabili- 
ty of it returning and hitting Earth with any live organism is considered small 
enough to be ignored. Some analysis predicting the probability of the vehicle 
hitting the Earth at some distant point in the future is desirable to confirm this 
assumption. This path is always assumed to result in a lost sample and no sample 
canister breach. 

Probabilities: 

Nominal Trajectory - 0.99 - (Merkhofer, 1977), based on similar systems at JPL. 
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Highly Off-Nominal Trajectory (entry and break or bum-up) - 0.005 for 
propulsive capture. 

0.0001 - for direct entry and aerocapture. 

The chance of something happening other than a nominal trajectory is 1.0 - 0.99 = 
0.01. Given a trajectory that is targeted for Earth or very near Earth (the "edge" of 
Earth) in the first place, and the most likely failures resulting is no last midcourse 
bum (rather than a wildly erratic bum) an estimate of 50% of the 0.01 is chosen 
for the propulsive capture. If the propulsive capture vehicle enters the atmosphere 
to any significant extent, it will bum up in a few orbits. Detailed trajectory 
analysis is needed to confirm this probability guess. Merkhofer and Yen before 
him estimated a probability of 0.0001 (Merkhofer, 1977) for this event. This 
result is a function of the trajectory and dispersions. Merkhofer assumed the 
ERV/SRC would be targeted away from Earth for most of the return trajectory 
however. 

For direct entry and aerocapture, the capsule must enter the Earth’s atmosphere at 
an angle steep enough to result in sufficient gs or heating such that the capsule 
breaks up. Initial calculations concerning an Apollo shaped capsule with a 
diameter in the range of 2 meters and a mass on the order of 400 kg indicate that it 
might require 200 gs or so to break up. This would require an entry angle of 20 
degrees or more, depending on the entry velocity. This angle seems large and 
perhaps difficult to achieve, leading to the guess that break-up will be unlikely, 
maybe 1 chance in 100. Trajectory analysis is needed to confirm this estimation. 
Given that the chance of achieving this trajectory is 1 in 100 and that the chance 
of being off-nominal at all of .01, .01/100 = .0001 

Miss Earth - 0.005 for propulsive capture based on 1.0 - 0.99 -.005. 

0.0099 for aerocapture and direct entry based on 1.0 - 0.99 - 0.0001 = 0.0099. 

6.2 Event: Break-up in Atmosphere - Following an entry at a steep angle and high gs or 

entry with no heat shield in the propulsive capture case, the vehicle breaks up in 
the atmosphere. G and aero forces, and melting are assumed to cause the break- 
up. Following break-up, the sample canister is assumed to be breached. The 
chief question of interest becomes whether or not the sample and sample con- 
taminated hardware will be sterilized. For estimation purposes, assume the 
sample is dumped from its container, shortly before entry. The sample consists of 
small rocks, sand, silt and many size particles. 

This event occurs because the aerobraking or reentry vehicle entered the Earth’s 
atmosphere either more rapidly than designed or due to an uncontrolled entry 
where the vehicle entered with the heat shield in the incorrect orientation. The 
result is the destruction of the vehicle and the exposure of the SCA to the atmo- 
sphere. The SCA is a light weight structure and will be subjected to temperatures 
in excess of alloy melting temperature. The sample will undoubtedly be lost. The 
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issue is whether the entry heating will be adequate to sterilize the sample by 
thermally decomposing any complex organic molecules, such as DNA. 


Possible 

Results: Sterilized - All parts of the sample are heated to a temperature at which steriliza- 
tion is almost certain for small life forms carrying genetic information in long 
chain molecules. This temperature is estimated to be in the range of 200°C for a 
few minutes. If the SCA canister remains in large pieces for part of the entry it 
will be aerodynamically heated to the degree that complete sterilization can occur. 

Unsterilized - Some of the sample is not heated sufficiently to sterilize it and it 
lands on the Earth's surface, resulting in contamination. The only way that the 
sample can escape sterilization is if the sample containing tubes are breached 
rapidly and the fine grained Martian soil is released into the upper atmosphere. 
The material will then be slowed down, but the fine particle size allows radiation 
and convective cooling at a rate rapid enough that sterilization may not be 
complete. The preservation of organic material in fine cosmic dust particles 
indicates that such a process is possible on fine grained material. 

Probabilities: 

Sterilized - 0.75 - If the capsule can be designed to contain the sample until it has 
been heated sufficiendy to sterilize the sample, sterilization may work. This will 
probably result in some weight penalty due to replacing aluminum alloy with 
Inconel for example. The probability is somewhat arbitrarily picked. Analysis 
can probably determine if it is possible to build a SRC/container that will sterilize 
in all situations. If it is possible then this number can be much closer to 1 .0. 

Unsterilized - 0.25 - Small dust particles have been shown to not experience 
significant heating during entry. If the sample is released from the container, 
prior to being sterilized by the heat, then contamination may be assumed to occur. 

6.3 Event: Go On Batteries - The SRC will be powered by the ERV until four hours before 

Earth entry, or Earth Orbit Insertion (EOI) bum, depending on the option. At this 
point the SRC will go on its internal battery power and separate from the ERV. 
The SRC internal power system is currendy planned to use three separate battery 
packs, providing a total of 150 % of the required power. One battery pack can be 
lost and have no effect on the mission. If two are lost, only 50% of the required 
power is available. 

Possible 

Results: Three or Two Battery Packs Function - This results in a nominal mission with 
150 or 100 % of required power. 
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One or No Battery Packs Function - With no internal power, the mission is cer- 
tain to fail for the aerocapture and propulsive capture options. The direct entry 
option, if designed properly and given enough mass, might be able to enter and 
impact the Earth’s surface, reasonably intact, but the seals on the canister are 
likely to be broken, resulting in possible contamination. In addition, lack of 
control will probably result in a large error ellipse on the ground. For these 
reasons, in the event of no power, it would be desirable to not separate the ERV 
and SRC and between the two of them, try to arrange a bum that would cause 
them to miss Earth. The feasibility of this is a function of the trajectory and the 
mass that can be added. This requires study, but is generally assumed to be 
possible and is the nominal plan assumed for this calculation. This is assumed to 
occur for all three options and to occur in the event of no power or just one battery 
available. 

In the event only one battery pack functions, only 50% of the power requirement 
of the vehicle is available. The mission will be degraded, though it is difficult to 
predict how much. At some point the vehicle will run out of power. For the cases 
resulting in Earth parking orbits, power loss may occur after establishment of the 
orbit. It then becomes more difficult to locate (no transponder) and capture (no 
attitude control) the vehicle. For the direct entry case, insufficient power may be 
available to ignite pyros or parachute mortars or run a locator beacon. In any 
event, the risk of contamination will be increased, and the nominal procedure is 
assumed to be an ERV/SRC bum using ERV power to miss Earth. More study is 
required to determine if this is indeed the best course of action. 

Looking at the probabilities below, the probability of one or no batteries function- 
ing is so small, that whatever happens after such a failure will be very improbable, 
thus the branch following this failure is not very important. 

Probabilities: 

One or No Battery Packs Function - 0.00000001 - (lx 10^-8) Given a probabil- 
ity of failure of one battery of .0001 (a reliability of 0.9999), the probability of 
two out is calculated to be (.0001) A 2 x (1 -.0001 ^(3-2) = 1 x 10 A -8. The probabil- 
ity of three out is (.0001) A 3 x (l-.OOOl^O-S) = 1 x 10M2. 1 x 10 A -8 + 1 x 10 A - 
12 = (approx.) 1 x K^-S. 

The reliability of a single battery is an estimate. A single battery is assumed to be 
at least as reliable as a single pyro unit, estimated to have a reliability of 0.9999 
(Vaughn and Graves, 1988). Better estimates can undoubtedly be located. 

Three or Two Battery Packs Function - 0.99999999 - This is the residual left 
over after the calculation above is performed. 

6.4 Event: ERV/SRC Burn to Miss Earth - Given a failure of two or more battery packs or 

failure of the ERV to separate, the ERV/SRC combination must make a bum that 
allows it to miss Earth. Propulsion on both the ERV and SRC can be used. In the 
event of SRC battery failure, ERV power can be used. 
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Possible 

Results: Nominal Burn - The ERV/SRC makes an adequate bum and misses Earth 
resulting in a lost sample. The probability of the vehicle returning and impacting 
Earth in the future is assumed to be so small as to be negligible, but this requires 
analysis to confirm. 

Burn Fails - The bum is not made or is inadequate to miss Earth. There are a 
number of possibilities following such an occurrence, but the inability to make 
such a bum implies a serious problem and an uncontrolled entry at a relatively 
shallow angle is assumed to result. More possible results could also be mapped, 
but the probability of this whole branch is so low that the effort would be wasted. 

Probabilities: 

Nominal Burn - 0.9 - Given one failure another may be more probable. 

Burn Fails - 0.10 - The residual. 

6.5 Event: Uncontrolled, Low-angle Entry - The vehicle, due to lack of power, an attached 

ERV, or other failure, makes an uncontrolled entry. This event occurs when the 
aerodynamic SRC, either that designed for aerobraking or for direct entry, enters 
the atmosphere without any attitude control. The vehicle may either orient itself 
so that it is aerodynamically braked and eventually hits the Earth, or the vehicle 
may break up due to high loads or orientation in a direction without the heat 
shield in the proper direction. The vehicle can probably be designed to survive an 
uncontrolled entry. A Discoverer type capsule could be used. The Discoverer 
design (see Fig. 3.3-2) orients itself in an aerodynamically stable position without 
active control. The uncontrolled capsule will have a much larger landing foot- 
print, perhaps on the order of 10 x 30 nm as opposed to an ellipse on the order of 
2 x 5 or so (Apollo numbers). Designing a nominally controlled capsule to 
survive uncontrolled entry will probably come at some cost in mass. 

Probable 

Results: Intact to the Surface - If the vehicle orients itself in the correct direction and 
remains at least partially intact, then the SRC Canister will impact the Earth. The 
impact is of an intact SRC. Subsequent branches cover whether the SRC is 
breached or not and whether it is found if it is unbreached. In any case the 
sample’s thermal control is lost. The best that can happen is that the sample is 
found intact just warm. 

Breakup in atmosphere - The vehicle breaks up in the atmosphere for any 
number of causes and the SRC does not reach the surface of the Earth intact. The 
breakup in the atmosphere branch refers to breaking up the SRC Canister. 
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Probabilities: 

Intact to the Surface - 0.95 - For direct entry and aerocapture. If the weight 
penalty can be paid, a capsule can probably be designed to survive intact to the 
ground. This number assumes most of that penalty will be paid. For a given 
design, this number is testable. 

Break-up in Atmosphere - 0.05 - for direct entry and aerocapture, the residual. 

6.6 Event: Surface Impact with No Chute - The main chutes fails to deploy or malfunctions 

significantly resulting in a high velocity impact with the Earth’s surface. 

Possible 

Results: Sample Canister Breached - The impact results in rapture of the sample 
container. In water, contamination will certainly occur following this. On land, it 
may well occur. 

Sample Canister Unbreached - The impact does not rupture the sample con- 
tainer. The sample is contained. 

Probabilities: 

Sample Canister Breached - 0.30 - A breach in the sample container can be 
avoided by careful packaging and addition of materials to absorb the energy of the 
impact. This may cost weight however. Balsa is one candidate energy absorber, 
causing an estimated weight penalty on the order of 10 kg. Another concept 
involves placing the sample in a tough, flexible bag that would contain it while all 
the metal around it is deformed. The energy absorption system is easily testable 
and could be well developed at the cost of capsule mass. On the other hand, the 
seals of the canister are likely to be fragile. Contamination is defined hereas as 
little as a loss of seal integrity and exposure of some of the sample to air. 

Terminal velocity of the capsule is estimated to be in the range of 210 ft/sec. 
Peak decelerations are estimated to range from 2,000 g’s (water landing) to 4,000 
gs (landing on rock) based on an analysis to estimate water landing loads. The 
program was modified to estimate land landing loads. 

The 0.30 number is a guess. Testing can determine this number precisely. 

Sample Canister Unbreached - 0.70 - See above, 1.0 - 0.30 = 0.70. 

6.7 Event: Search for SRC on Earth -This event is the search for an SRC which has landed 

without parachutes and not been breached. The search would not be aided by any 
radio beacon due to the fact that the vehicle would not be equipped with one 
durable enough to survive a hard landing. A land landing is assumed because the 
primary requirements are to find the sample and not contaminate the Earth. Land 
landings offer the best chance for both of these. A land area can even conceivably 
be sterilized in the event of a breach of the sample container. 
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Two different cases must be noted. In one case, the impact follows failures on- 
orbit resulting in an uncontrolled entry or other failures resulting in landing in a 
randomly determined area. Decay of a parking orbit is a good example of this 
kind of failure. The capsule will be much more difficult to find in this case. 

The other case involves failures on the nominal trajectory, after entry, such as a 
parachute failure. The nominal landing zone would still be used. The vehicle 
would just hit hard. 


Probable 

Results: SRC and Canister Found - If the intact SRC is found, die sample will have been 
warmed above the required -40°C, assuming that it lands in areas other than the 
Antarctica, Greenland or the Arctic regions of Eurasia or North America during 
the winter. A nominal landing zone would be in a Southwestern U.S. desert, in 
the Midwest U.S. wheat fields or in the Central Soviet Union. 

SRC and Canister Not Found - If the sample is not found it obviously has no 
value and adds to the risk of contamination. 

Probabilities: 

SRC and Canister Found - 0.50 - For the random landing. The SRC will be 
tracked prior to entry by NASA, NORAD and its Soviet equivalent. Thus the 
impact location will be estimated within an ellipse a few miles wide and at most a 
few tens of miles long, within an area of a few hundred square miles. If the SRC 
lands in the ocean it can easily be lost. If it lands in a flat area with either little 
vegetation or row crops the probability of discovery is very high. If, on the other 
hand it lands in a forest or jungle it may not be found. Since the oceans occupy 
70 percent of the Earth’s surface and forest and jungle cover about a third of the 
land, the probability of discovery is about 20% if the landing area is randomly 
chosen. 

The above philosophy is based on experience with searches that may be rather 
poorly funded compared to what would be expected for this search. Given the 
sample is in a known area, land or water, die search will continue until the 
searchers run out of money. Ignoring factors associated with time-consuming 
searches such as theft of the sample by non-government searchers, and burial of 
the sample with sediment, the probability of finding the sample goes up with the 
money and time spent. A search like the one conducted for nuclear warheads lost 
in the Mediterranean could be expected and the probability of finding it is 
assumed to be significantly better than 20%. 

0.99999 - for landing in the nominal landing zone. The nominal landing zone will 
be on land in a cleared area. Given adequate time and money, and baring simple 
theft and other strange misfortune, it is difficult to conceive of losing the sample. 

SRC and Canister Not Found - 0.50 - For the random case, the residual. 

0.00001 - For the targeted case. The residual. 
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6.8 Event: ERV Separation - Based on internal or ground commands the ERV and the SRC 

will separate approx, four hours prior to Earth entry. This event is a function of 
the correct functioning of the data and communications systems, both redundant, 
and a minimum of 3 pyros. 

Possible 

Results: Nominal Separation - The command is sent, all three pyros fire, and nominal 
separation occurs. At the present time, the ERV is assumed to enter the Earth’s 
atmosphere for all but the propulsive capture case, and no further attention is paid 
to it. The probability of contamination of the ERV is assumed to be very small. 
A sterile transfer is to have taken place in Mars orbit. Any detected anomaly in 
this transfer would be cause to leave the vehicle in Mars orbit. 

Failure to Separate - At least one of the three pyros does not fire and the two 
vehicles do not separate. Following this failure, an attempt is made to do a bum 
that causes the vehicle to miss Earth. 

Probabilities: 

Nominal Separation - 0.9996 - Each pyro is assumed to have a reliability of 
0.9999. The probability of at least one failing is (.9999) A 3 = 0.9997. An addi- 
tional 1 chance in a thousand is thrown in to account for failures of the data/com/- 
power distribution/etc. 

Failure to Separate - 0.0004 - The residual. 

6.9 Event: Direct Entry - For the direct entry option, the vehicle enters the atmosphere at 

any angle shallow enough to avoid break-up, predicted to be anything less than 20 
degrees. 

Possible 

Results: Nominal Entry is a controlled entry leading to the nominal sequence. 

High Skip is an entry at such a shallow angle that the vehicle skips out and misses 
Earth. Other reasons for a high skip and miss might include a guidance or 
navigation failure of some kind such that the vehicle is guided out of the atmo- 
sphere. 

Skip to Orbit or High Gamma Entry - These cases, though radically different, 
have the same result, an uncontrolled entry. 

In the skip to orbit, the vehicle skips out, but enough energy is lost to put it in an 
elliptical oibit. The orbit will pass through the atmosphere at each perigee and 
will therefore decay quickly to an unplanned landing. 

In the high gamma entry, the entry will be far too steep due to some failure, 
resulting in high gs and loss of control. 
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Probabilities: 

Nominal Entry - 0.99 - This is an estimate, subject to dispute. Historical data 
from past programs resulting in entries could be researched to come up with a 
better number. 

High Skip - 0.003 - The residual probability remaining after nominal entry is 
0.01. The high skip is felt to be somewhat less likely than the alternative, 
resulting in an uncontrolled entry and is therefore assigned 30 % of the residual. 

Skip to Orbit or High Gamma Entry - .007 - The other 70 % of the residual 
(0.01-0.003). 

6.10 Event: Aerocapture Maneuver - The SRC goes into die atmosphere and dissipates 

enough energy to enter an orbit with apogee near the Freedom Space Station orbit. 
After exiting the atmosphere and reaching apogee, a circularization bum raises the 
perigee out of the atmosphere. 

Possible 

Results: Nominal - The SRC enters and exits the atmosphere on a trajectory close enough 
to nominal to enable circularization in a near Freedom Space Station orbit. 

Exit Early - The SRC leaves the atmosphere before dissipating enough energy to 
get the apogee low enough to allow retrieval by the OMV. If the vehicle’s perigee 
can be raised out of the atmosphere, the SRC will go into a long term, but perhaps 
inaccessible orbit. 

Unplanned Entry - The SRC enters the atmosphere and dissipates too much 
energy, resulting in an inability to exit the atmosphere or an apogee that is too 
low, resulting in entry in a few orbits or tens of orbits. 

Probabilities: 

Nominal - 0.99 - an estimate, subject to dispute. The aerocapture maneuver is at 
least as complicated as the midcourse, which has a referenced 0.99 success 
estimate. 

Exit Early - 0.005 - one half of the residual. 

Unplanned Entry - 0.005 - the other half of the residual. 

6.11 Event: Remove Cover - Prior to release of the drogue chutes during direct entry, a cover 

or shroud, covering the chutes is assumed to be released by three pyrotechnic 
devices. The release of the cover reduces the hung weight and uncovers the 
chutes. 
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Possible 

Results: Nominal - The pyrotechnic devices fire as planned and the cover is removed. 

Cover Not Removed - Due to signal or pyro failures, the cover does not come 
off. The chutes can therefore not deploy and the capsule hits the ground at a high 
velocity. 

Probabilities: 

Nominal - 0.9996 - Given a reliability for a single pyro unit of 0.9999 (Vaughn 
and Graves, 1988), the reliability for the system is (0.9999) A 3 = 0.9997. An 
additional .0001 is subtracted to account for reliability in the system sending the 
signal to the pyros. 

Cover Not Removed - 0.0004 - the residual. 

6.12 Event: Drogue Deployed - Two redundant, mortar-deployed drogue chutes may be used 

to stabilize the capsule and slow its descent rate some, prior to opening the main 
chutes. In Apollo, the drogues were deployed at 25,000 ft. and the mains at 
12,000 ft. Prior to deployment of the mains the drogues were cut away. 

Possible 

Results: One or Both Drogues Deployed - At least one drogue is deployed as planned. 

The system is designed for one drogue deployment as a nominal case. The second 
drogue is redundant. 

No Drogues Deployed - If for some reason no drogue chutes deploy, the capsule 
may be tumbling, and will certainly be going faster when the main chutes deploy. 
If the mains can be designed to take the dynamic pressure without the drogues, the 
probability that they will deploy is still very high. It is assumed the main chutes 
can be designed to take diis dynamic pressure and that some weight penalty will 
result. 

Probabilities: 

One or Both Drogues Deploy - 0.99999999 - The military currently has roughly 
one malfunction per 10,000 live jumps with the T-10 chute. Fatalities are 1 per 
one million jumps. The malfunction probability is therefore 0.0001. With two 
redundant chutes, the probability is (0.0001) A 2 = 0.00000001. The probability of 
success is the residual. It has been estimated that the reliability of the standard 
military chute could be substantially increased by better packing. On the other 
hand, the MRSR chute will never be tested and developed to the degree the 
military chute system has been, and must survive the space environment for three 
years or more. Apollo testing showed chutes could remain packed for four years 
without degradation however (Kiker, 1988). 

No Drogues Deploy - 0.00000001 - See above. 
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6.13 Event: 


Main Chutes Deployed - Two mortar-deployed, redundant main canopies are 
assumed to deploy somewhere around 10,000 ft. The deployment mechanism is 
assumed to be an atmospheric pressure switch firing the mortars and the drogue 
cutaway pyro simultaneously. The pressure switch must be armed by the 
sequencing logic at some point higher in the trajectory and power must be 
provided to the initiators. 

Failure to cut away the drogues will result in some small increase in the probabil- 
ity of malfunction of the mains, but this is ignored here. The main chutes are 
assumed to be designed to be deployable even in the absence of one or both 
drogues. It is assumed they will be able to take the greater dynamic pressure due 
to the higher airspeed. 


Possible 

Results: One or Both Mains Deployed - The main chutes are assumed to be redundant. If 
at least one successfully deploys, a normal landing is assumed to take place. 

No Mains Deploy - Failure of both main chutes to deploy will result in a high 
velocity landing. 

Probabilities: 

One or Both Mains Deployed - 0.99999999 - See discussion for drogue chutes. 

0.99 - if no drogues deploy (Kiker, 1988). Failure of at least one drogue to deploy 
will significantly reduce the chance of a successful main chute deployment, 
however, if the system is properly designed, successful main chute deployment 
can still be made quite probable. If at least one drogue does not deploy, the 
capsule will be going much faster at main chute deployment and may also have 
some tumbling motions that might lead to a malfunction in the mains. 

No Mains Deploy - 0.00000001 - The residual. 

0.01 - if no drogues deploy. The residual. 

6.14 Event: Air Snatch - In order to reduce the chance of contamination as much as possible 

and increase the chances of maintaining the required thermal conditions (-40° C), 
the SRC, hanging from one or more chutes, will be snatched in the air by a large 
aircraft and brought on board using a technique developed over a long period of 
time for military film canisters. Even if the air snatch is missed, a relatively 
nominal landing on land is anticipated, with a somewhat greater chance of the 
sample warming up. 


Possible 

Results: Success - The SRC is swung into the interior of the aircraft and placed in a 
biological containment canister capable of providing thermal control to the 
sample. 
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Miss - The SRC makes a land landing, with no breaching of the sample, given at 
least one functional chute. Given a rapid ground response and location of the 
capsule before it gets too warm, the mission can still be a complete success. 

Probabilities: 

Success - 0.97 - This is approximately the success rate for military air snatch 
operations (Kiker, 1988). 

Miss - 0.03 - The residual. 

6.15 Event: Aircraft Landing - Following successful air snatch and onboard containment and 

thermal control of the sample, the aircraft flies to a designated location and 
unloads the sample for ground transport to an analysis laboratory. 

Possible 

Results: Nominal - The aircraft returns and lands without incident. 

Crash - The aircraft crashes between successful snatch and landing. The sample 
may or may not be breached. 

Probabilities: 

Nominal - 0.999999 - There is roughly one fatal accident in one million aircraft 
operations (takeoff or landing) in the U.S. air carrier fleet (Merkhofer, 1971). The 
sample carrying aircraft should do at least this well. 

Crash - 0.000001 - The residual. 

6.16 Event: Container Breakup in Aircraft Crash - In the event of an aircraft accident, most 

probably related to landing, the SRC will be in a thick-walled, thermal controlled 
containment. 

Possible 

Results: Container Breakup - Yes - the containment is broken and the sample is exposed 
to the air and thermal control is lost. Contamination is therefore considered to 
have occurred. 

Container Breakup - No - The containment remains intact, but it is assumed that 
thermal control is lost and the sample warms up to some extent. 

Probabilities: 

Container Breakup - Yes - 0.01 - The sample container can be heavy and strong 
(half-inch steel). A well designed container can survive a substantial crash. 

Container Breakup - No - 0.99 - The residual. Even if the container does not 
breakup, thermal control is assumed to be lost. 

6.17 Event: Ground Response to Air Snatch Miss - In the event an air snatch is missed, the 

ground personnel must quickly find and thermally control the sample. 
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Possible 

Results: Fast Response - The sample is quickly recovered before thermal limits are 
exceeded. This is far more difficult to do at sea than on land due to the high heat 
capacity and thermal conductivity of water. 

Slow Response - The ground cannot find the sample and plug in thermal control 
before it warms up. 

Probabilities: 

Fast Response - 0.9 - Helicopters can back up the main recovery aircraft and 
quickly locate and direct ground vehicles to the sample. The recovery aircraft can 
also do the same. 

Slow Response - 0.1 - The residual. 

6.18 Event: Orbiter Entry - This event is the combination of all of the events that occur from 

the time the orbiter begins to undock with the Freedom Space Station until it 
begins final approach for landing. 

Possible 

Results: Nominal Entry - The next event is landing. 

Orbiter Breakup during entry - The SRC Canister would be exposed to the 
airstream after breakup occurred. Following breakup, if the sample container is 
properly designed, it may sterilize the sample with heating prior to releasing it. If 
breakup occurs after the heating phase of entry, the sample will not be sterilized, 
however the container will still hold it. 

Probabilities: 

Nominal entry - 0.999 - The Orbiter has made 24 successful entries in 24 
attempts. Other than failures of the thermal protection system, the entry phase has 
a high degree of redundancy. 

Crash or Orbiter Breakup during Entry - 0.001 - This sort of event could occur 
due to either a guidance or control failure or possibly a critical high temperature 
black tile coming off during launch. This sort of failure has been considered in 
Orbiter design, and the design has been certified as part of the Orbiter reevalu- 
ation following the 51-L incident. 

6.19 Event: Orbiter Lands - Following a successful deoibit and entry the Orbiter lands. A 

variety of failures are possible, ranging from the landing gear’s failure to deploy 
or a hard landing, resulting in gear collapse to a flight control failure. 


Probable 

Results: Nominal - The successful landing of the orbiter terminates the mission and results 
in the delivery of the sample to a waiting team of curation and scientific person- 
nel. 
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Crash - A crash should not normally result in the canister pallet breaking loose 
from the trunnion and keel fittings. The pallet is designed to remain in place even 
following a crash as are all orbiter payloads. 

Probabilities: 

Nominal - 0.999 - The flight record is for 24 successful landings for 24 attempts 
following orbital flights and 6 successes for 6 attempts during the Approach and 
Landing Tests. 

Crash - 0.001 - The residual probability. 

6.20 Event: Orbiter Breakup on Entry - The event is the destruction of the Orbiter due to a 

TPS bum through, malfunction, or operational error. The event results in the 
exposing of the SRC Canister to the airstream. The canister will be heated to high 
temperatures. The canister and associated debris will hit the Earth at high 
subsonic velocities. The sample has certainly been degraded at this point, the 
only question is whether or not it has been sterilized. 


Probable 

Results: Sample Sterilized - The sample container is heated either as a whole or after 
breaking up to temperatures that decompose complex organic molecules (such as 
DNA) that are critical for the Martian pathogens to reproduce. 

Sample Not Sterilized - The sample container is broken up and parts of the clay 
and fine sand portions of the sample are aerodynamically slowed before they are 
heated to sterilizing temperatures. 

Probabilities: 

Sample Sterilized - 0.95 - Hard data is not available that can be used to estimate 
this probability. However, the most likely scenario is that the SRC container 
would be designed to withstand high aerodynamic and heating loads. In our study 
of MRSR requirements affecting Freedom Space Station (Simonds, 1988) it was 
recommended that the SRC Canister be made of Inconel 718 which maintains its 
strength at temperatures in excess of 900°C. 

Sample Not Sterilized - 0.05 - The residual. 

6.21 Event: Pallet Breakup following Orbiter crash landing - As a result of a crash landing 

thermal control of the sample will certainly be lost, since the ground crew’s top 
priority will be the rescue of the crew. 


Probable 

Results: Degraded Sample - A degraded, that is a warm sample will result from the loss 
of thermal control. However, the SRC and the SRC Canister should remain intact. 

Canister Breach - The sample canister, inside the SCA and SCA canister, is 
breached. 
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Probabilities: 

Degraded Sample - 0.99 - This is the likely event since the pallet is designed to 
not break loose from the orbiter during a crash and the SCA Canister is designed 
to withstand impact loads. The probability is estimated at 0.99 to cover the 
possibility of loads in excess of those for which the SCA canister is designed. 

Canister Breach - 0.01 - The residual. 

6.22 Event: SRC Docking and Freedom Space Station Processing - This event encompas- 

ses a series of operations covering the docking of the OMV, placing of the SRC in 
the SRC canister on the truss mounted pallet, and transfer of the SCA from the 
SRC to the SCA canister. The baseline level of processing considered in this 
scenario is simply repackaging of the SCA from the SRC into the SCA canister, 
mounted on the pallet, attached to the Freedom Space Station Truss. This 
scenario was developed by Eagle Engineering (Simonds, 1988). This event is 
unique in that it is possible to contaminate the Freedom Space Station without 
damaging the sample, since the probable paths for contamination are due to 
malfunctions in the sample handling in Mars Orbit. 

The steps in SRC docking and processing the sample on the Freedom Space 
Station include: 

Docking of the OMV, placing of the SRC in the SRC canister on the tmss 
mounted pallet. 

Removing the SCA from the SRC and placing the SCA in the actively cooled 
SCA canister, mounted on the same pallet mounted on the truss. The SCA 
canister cooling system may keep the sample within specifications with a simple 
sun shade. 

Placing the complete SRC canister and SCA canister and the attached pallet in the 
Orbiter payload bay. 

Supplying the pallet with any utilities from the Oibiter, and preparing the Orbiter 
for deorbit. 


Possible 

Results: No contamination of Freedom Space Station - The nominal case. 

Contamination of Freedom Space Station - This case assumes that Mars dust 
has somehow gotten outside the SCA in the SRC. This dust has then found its way 
to the Freedom Space Station itself. This can be due to contamination of the 
exterior of the SRC due to an undetected sterile transfer failure in Mars orbit or 
some other failure. 
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Loss of Sample Thermal Control - Due to a system failure or human error, the 
sample becomes too warm. Measures can probably be taken to reduce this 
probability to a small number, but some expense may be involved. For the simple 
repackaging scenario proposed here, the sample is assumed to use passive thermal 
control measures with a sun shade. A detailed thermal analysis is required 
however to make sure this will work. 

Probabilities: 

No contamination of Freedom Space Station - 0.995 - (Really 0.999 if the loss 
of thermal control case, 0.004, is included) Extreme precautions are going to be 
taken to confine the SRC canister, thus the probability that the station is con- 
taminated is arbitrarily set at 999%. The real danger may be failure of the sterile 
transfer in Mars orbit and contamination of the exterior of the SRC. Numerous 
redundancies can be designed into the handling process at the Station, making the 
probability of contamination very low. 

Contamination of Freedom Space Station - 0.001 - Freedom Space Station 
contamination probability is arbitrarily set at 0.001. 

Loss of Thermal Control - 0.004 - This number is subject to dispute. 
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6.23 Event: OMV Launched and Deployed - This event is the single most important event 

influencing the overall probability of getting a degraded sample for the aero- 
capture and propulsive capture to the Freedom Space Station options. This event 
encompasses the complete process of getting the OMV from Earth to leaving the 
Freedom Space Station on the way to picking up the SRC. This aspect of the 
mission assumes that the OMV is attached to the Freedom Space Station, not the 
Orbiter. As of the date of preparation of this report, this assumption is contrary to 
the NASA Freedom Space Station baseline. TTie OMV does not have a place to 
park on the Freedom Space Station. For a variety of reasons, however, parking 
the OMV at the Freedom Space Station is the preferred method for use of the 
OMV with die Freedom Space Station for this case. There is effectively no way 
to bring the SRC to the Freedom Space Station without the OMV. Getting the 
OMV deployed on-orbit involves the following steps: 

a) Preparation and Checkout of the OMV at KSC 

b) Mounting the OMV in the Orbiter 

c) Launching the Orbiter 

d) Rendezvous of the Orbiter with the Freedom Space Station 

e) Transfer of the OMV to the Freedom Space Station 

f) Checkout of the OMV on the Freedom Space Station 

g) Maintenance and repair of the OMV, including refueling the OMV for 
the recovery of the second SRC (these calculations only address one 
mission however) 

h) Deployment of the OMV from the Freedom Space Station 

Probable 

Results: Nominal - The nominal case is that the OMV is ready to retrieve the SRC within 
the time that it can maintain thermal control of the sample on-orbit. This time 
period may be as litde as three orbits or as long as 90 days. 

Slow Deployment - Slow deployment means an OMV deployment that is not in 
time to retrieve the SRC within die thermal control of the sample. It is assumed 
that passive thermal control of the SRC without attitude control is not possible. It 
is further assumed that a spin stabilized SRC would not be stable in the correct 
orientation with the Sample container pointed away from the Sun to maintain 
thermal control. 

Not Deployed - Not Deployed means that the OMV cannot be deployed to 
retrieve the SRC within the orbital lifetime of the SRC. Thus the SRC does an 
uncontrolled reentry. See section 6.24 and section 11.0 for estimates of the orbital 
lifetime of the SRC. 

Probabilities: 

Nominal - 0.94 - The nominal case is essentially the probability of the normal 
functioning of the Shuttie program for some period of time prior to and during the 
OMV deployment. This number is basically the residual left over after the two 
estimates that follow. 
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Slow Deployment - 0.05 - Prudent mission planning would manifest the OMV on 
a Shuttle flight to the Freedom Space Station in advance of the SRC arrival at 
least one logistics flight earlier than needed, that is somewhere between 90 and 
180 days prior to earth orbit insertion. Thus only a complete halting of Shuttle 
launches as occurred after 51-L could prevent deployment. The OMV should be 
readily maintained on-orbit, assuming that adequate spares are available. Thus 
the probability of slow deployment is almost totally that of a 51-L type hiatus in 
Shuttle launches. The probability of that event is assigned a value of 0.05. If 
every flight had a 0.99 ascent success probability, then five flights would have an 
ascent success probability of (0.99) A 5 = 0.95. Five flights represent some time 
frame on the order of a year or less in which a 51-L type accident could slow 
deployment of the OMV. 

Not Deployed - 0.01 - The most likely event to prevent the deployment of the 
OMV is its loss during a Shuttle launch. There is only one OMV planned at this 
time. This event has been assigned a probability of 0.01. This number assumes 
the probability of a successful Shuttle ascent is 0.99. 

6.24 Event: OMV Recovery - The OMV recovery sequence begins when the OMV is 

undocked from the Freedom Space Station and ends when the OMV and re- 
covered SRC enter the proximity operations volume around the Freedom Space 
Station. The process involves the following steps: 

a) Getting an adequate state vector for the SRC. 

b) Having the SRC rotation rates within the abilities of the OMV to dock 
with it. 

c) Loading the OMV with the proper state vectors and bum calculating 
algorithms. 

d) Deploying the OMV. 

f) Orienting the OMV and commencing a bum sequence. As many as 10 
bums may be needed. 

g) Having the OMV proximity operation sensors lock on the SRC. 

h) Matching the OMV and SRC attitude rates. 

g) Docking the OMV and SRC. 

h) Reorienting the combined SRC and OMV and beginning a series of 
bums back to the Freedom Space Station (10 bums). 

i) Entering the Freedom Space Station proximity operations volume. 

j) Docking with the Freedom Space Station. 

Probable 

Results: Nominal - The nominal case involves a complex series of navigation and state 
vector updates, propulsive maneuvers and proximity operations, the majority of 
which are ground controlled. The OMV will be controlled from the Freedom 
Space Station when it is within a certain minimum range. 
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Slow Recovery - Slow recovery means an OMV recovery that does not permit the 
SRC to maintain thermal control of the sample. It is assumed that passive thermal 
control of the SRC, lacking attitude control, is not possible. It is further assumed 
that a spin stabilized SRC would not be stable in the correct orientation with the 
sample container pointed away from the Sun to maintain thermal control. 

No Recovery - Means that the recovery can not be completed within the orbital 
lifetime of the SRC. Thus the SRC does an uncontrolled reentry. The following 
brief table (computed using Richter, 1966) gives an idea of the orbital lifetime of 
a small satellite based on the 1962 standard atmosphere. The atmosphere model is 
near worst case. In the conclusions and recommendations section (11.0), a 1972 
atmosphere model is used with variations for the solar cycle to get a better idea of 
the lifetimes involved. Changes in the solar flux, which vary with the sunspot 
cycle, can increase the density by a factor of 10 and bring the vehicle in much 
quicker. The ballistic number of the vehicle (W/Cd*A) is assumed to be on the 
order of 18, using a weight of 800 lbs, a Cd of 1.8 and an area of 24 ft sq., based 
on a 5.6 ft (1.7 m) diameter Apollo shape. 


Apogee 

Perigee 

Lifetime/Ballistic 

Orbit 

Altitude 

Altitude 

Number 

Lifetime 

nm 

nm 

day/(lb/ft sq.) 

days 

250 

250 

20 

360 

230 

230 

10 

180 

220 

220 

7 

126 

150 

150 

0.8 

14 

290 

190 

9 

162 

290 

100 

0.6 

11 

250 

80 

0.25 

5 

250 

70 

0.10 

2 

;ies: 

Nominal 

- 0.98 - 

The best data base for such 


controlled rendezvous and docking maneuvers are the Soviet’s experience docking 
with Salut and Mir. They have experienced approximately 6 serious problems 
where vehicles either missed docking, or docking operations had to be aborted 
because closing rates were too high. However, most of the missions were 
eventually completed. A 0.98 success rate is assumed. It can be argued that to do 
the MRSR mission with Mars orbit rendezvous as is currently planned, the U.S. 
will have to develop a good system for near totally automated rendezvous. 


Slow Recovery - 0.01 - The OMV is designed to perform satellite servicing 
missions that are similar to recovering the SRC. The principle reason for a slow 
recovery might be SRC tumbling which would require development of special 
procedures to complete the recovery. Given the decay times shown above, there 
will be little time to develop new techniques or hardware to catch the sample if 
something goes wrong. 
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No Recovery - 0.01 - The OMV has a high level of redundancy to complete its 
mission and the recovery of the SRC should not be significantly different from 
other satellite servicing missions for which the OMV is designed. Thus the 
probability of 0.01 is assigned to no recovery. Multiple OMVs could also be 
placed at the Freedom Space Station. Only one OMV is currently planned 
however. 

6.25 Event: SCA Canister Impact - The impact of the SCA canister at a high velocity, into 

the Earth following breakup of the Orbiter during descent to landing. The 
possibility of breakup of the Orbiter following entry has not been considered in 
the calculations or the fault trees. Orbiter breakup during entry is assumed to 
result in a sterilized sample if the SCA canister holds together long enough (in 
theory recoverable) or an unsterilized sample scattered in the upper atmosphere if 
the canister melts or breaks up. Breakup after entry was considered improbable 
enough to be ignored in the most recent iterations of the fault trees and this 
section is therefore not used, but is included here for future reference. 


Probable 

Results: Unbreached SCA Canister - This event is the case where the SCA canister, 
made of Inconel 718, is able to stand a high velocity impact. It is dented but the 
seals stay intact. The result will be a warm sample that can be found. 

Breached SCA Canister - This case is the one where the SCA Canister seals are 
broken by the impact. The sample may be simply exposed to air or perhaps 
scattered over the surface. 

Probabilities: 

Unbreached SRC Canister - 0.10 - The canister may be designed to withstand 
high impact loads. If the canister is encased in a large amount of low density 
debris from the SRC, then it may hit at a low enough velocity that it remains 
intact, however this is assumed to be unlikely. 

Breached SRC Canister - 0.90 - Impact at high velocity will probably break the 
seals. 

6.26 Event: Perigee Raise Maneuver - Once the aerocapture maneuver is complete, the 

perigee of the orbit must be raised. If this is not done, the orbit will decay shortly, 
probably within the next orbit or two. See the table is section 6.24 for an idea of 
how fast orbits with low perigee decay. 

Possible 

Results: Nominal - Perigee is raised out of the atmosphere as planned. 

Fails (Entry) - Without the perigee raise maneuver, the vehicle will enter and 
impact die surface of the Earth within an orbit or two. 
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Probabilities: 

Nominal - 0.9999 - This bum uses the SRC hydrazine system and is assumed to 
have a high level of redundancy in thrusters, etc. This number is subject to 
dispute. 

Fails (Entry) - 0.0001 - The residual. 

6.27 Event: First Propulsive EOI Burn - For the propulsive capture case, given the con- 

figuration described in section 3.2, spinning two-stage solids, the first bum uses 
four STAR 14A small solid rocket motors, spinning around an axis to level out 
thrust inequalities. The second stage uses two STAR 14As. First stage consists of 
the bum of the first four and release of the four with pyro units. Other designers 
have proposed using small liquid motors to accomplish the same task. 

The SRC is also spun up by the ERV. Therefore, 7 events must happen, the ERV 
must be properly oriented, the SRC spun up and then released, and the four STAR 
14As must fire. The staging is considered part of the second bum event however, 
because failure to stage will probably result in a high elliptical parking orbit. 

Possible 

Results: Nominal Burn - The four first stage motors all bum nominally. The vehicle is 
accurately pointed, spun up, and released. 

Failures Resulting in a Flyby - The SRC could be improperly oriented, or not 
spun up. Failure to spin up would result in an improper orientation and probably 
tumbling at the time of the bum, or in effect, no bum. Failure of one of the 
motors to bum might also result in tumbling. 

Failures Resulting in a Capture or Entry - There are undoubtedly some failure 
modes resulting in an Earth entry (an unlucky orientation failure at spinup, and a 
failure to sense it and stop the bum), or in capture into a high ellipse, but these are 
assumed to be of such low probability that they can be ignored here. 

Probabilities: 

Nominal Burn - 0.9993 - Seven events, an orientation, a spinup, a pyrotechnic 
release, and four motor firings, all with a 0.9999 reliability result in a (0.9999) A 7 
reliability when required to all work. The actual reliability of the motor should be 
acquired. 

Failures Resulting in a Flyby - 0.0007 - The residual. 

6.28 Event: Second Propulsive EOI Burn - This follows the first bum of four STAR 14As. 

The four spent motors must be staged and the last two STAR 14As must bum to 
complete the insertion into low Earth orbit. Six things must happen. 
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Possible 

Results: Nominal Burn - The four spent motors stage, and the two remaining motors bum 
without incident. The vehicle is then inserted into a low Earth orbit on the order 
of 500 km circular (270 nm). 

Failure to Stage or Burn - Failure to stage or bum should result in placement of 
the vehicle in an elliptical orbit. It is assumed the first stage bum will place the 
vehicle in an elliptical orbit. The second stage bum is needed to reduce the 
apogee of the ellipse to within range of the OMV. It is assumed that any failure in 
the second stage bum will result in the vehicle being out of range of the OMV. 
This assumption requires analysis to verify. The orbit will have a perigee around 
500 km but with any one of a variety of apogees. Orbital lifetime can be from a 
few years on up. 

In the fault tree and calculations it is assumed that the lifetime will be such that 
the vehicle will re-enter the Earth’s atmosphere before it can be recovered. On the 
other hand, given adequate orbital life time, recovery may be possible. It will 
probably require an upper stage such as the Centaur or IUS matched with an 
OMV or other remotely controlled terminal docking device. 

Probabilities: 

Nominal Burn - 0.9994 - Given six events, four pyro firings for staging and two 
motor bums, all assumed to have a reliability of 0.9999 (Vaughn and Graves, 
1988 on pyros), the probability of all these happening is (0.9999) A 6 = 0.9994. 

Failure to Stage or Burn - 0.0006 - The residual. Any failure in the six events is 
assumed to result in placement in an orbit the OMV cannot reach and eventual 
uncontrolled entry. 

6.29 Event: Despin - For the propulsive capture option, following the two EOI bums dis- 

cussed above, the SRC must be despun to allow capture by the OMV. "Yo-yos" 
or weights on a string are deployed and then cut away to decrease the angular 
momentum of the SRC and get the spin rate down to 5 or 6 rpm. Failure to 
despin, or to cut away the yo-yos is assumed to make rendezvous with the OMV 
not possible. 

Possible 

Results: Nominal Despin - The SRC is despun and the yo-yos cut away without incident. 

Failure to Despin or Cut Away Yo-Yos - This failure results in a high spin rate, 
or a low spin rate with weights on strings spinning around. In either case, the 
OMV is assumed to be unable to capture the capsule. The orbital lifetime for a 
low circular orbit in the 230 to 270 nm range is on the order of 6 months to a year 
for high solar flux. A second or third try with improvised grabbing equipment 
may be possible after an initial failure. 
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Probabilities: 

Nominal Despin - 0.9997 - A command must release the yo-yos and one, maybe 
two pyros must fire to the cut them away. Assuming a probability of 0.9999 for 
each event, (0.9999) A 3 = 0.9997. 

Failure to Despin or Cut Away Yo-Yos - 0.0003 - The residual. 

6.30 Event: Shuttle Ascent - for Shuttle recovery, the Shuttle must ascend to the parking orbit 

within a given time frame defined by the life of the sample power supply and RCS 
fuel, if the sample is to be kept cold. If the sample is to be recovered at all, the 
Shuttle must get it before its orbit decays. For a lower Shuttle orbit (250 nm) at 
high sunspot times, this time period may be from less than a year to over two 
years, depending on the solar flux. See the decay and sunspot plots in the 
Conclusions and Recommendations section (11.0). The last solar maximum was 
around 1979-82. The high sunspot part of the 11 year cycle lasts three or four 
years. Plus 22 years (two cycles) gives us a maximum in 2001-2004. If the 
mission is launched in 1998 and lasts three years, it will return in 2001, putting it 
on the upswinging edge of high solar activity, expanded atmospheres, and fast 
orbital decay. 


Possible 

Results: On-Time Ascent - The Shuttle ascends to the parking orbit of the vehicle on time, 
probably somewhere between 0.1 and 90 days after the arrival of the sample in 
Earth orbit. It is not yet clear that the sample can keep cold for 90 days in low 
Earth orbit, unless it is powered and controlled the whole time. 

Late Ascent - This would be ascent after the sample had run out of power or RCS 
fuel and therefore lost temperature control. This would be something over 90 
days after the vehicle enters the parking orbit. 

No Ascent - Due to a 51L type failure, the Shuttle fleet is grounded for a long 
period of time, making a flight within the orbital lifetime of the capsule (6 months 
to several years) not possible. The capsule would therefore enter uncontrolled. 
The Russians or a CERY system might be able to back up the Shuttle, or a longer 
life parking orbit could be used. 

Probabilities: 

On-Time Ascent - 0.94 - Even before the Challenger accident, the NSTS program 
had a serious problem meeting schedules. The simple ascent success record for 
the program is 96 % (based on 25 flights). See Table 6.30-1 below for data on 
other vehicles. The overall average is roughly 91% see ascent success. The on- 
time record for given payloads is much worse, but was not calculated here. More 
analysis could probably quantify the record in detail. More analysis of the MRSR 
orbital vehicle is also required to determine how long it can maintain power, 
attitude control, and altitude, waiting for a launch. The longer this is, the better 
the probability of making the launch becomes. 
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Table 6.30-1, Launch Vehicle Ascent Success Probability 

(On-time performance not considered) (Simanis and Gubby, AIAA paper 
88-2627, 1988) 

Araine - 81% in 21 missions 

Atlas - 80% in 67 mission, 90% in last 20 missions 

Delta - 93% in 182 missions, 96% in last 20 missions 

Long March - 88% in 16 missions 

Titan - 96% in 137 missions, 90% in last 20 missions 

Shuttle - 96% in 25 missions 

Proton - 92%, oper. vehicle only, 85% - Proton family 
Overall average - 91.4% in 447 missions 

No Ascent - 0.02 - If the Shuttle has a 0.99 chance of successful ascent, then five 
missions have a 0.95 chance of all being successful. In other words, if the 
"window” for a 51-L type accident resulting in no recovery is within five missions 
before the scheduled recovery launch, then the chance of it happening is around 
5%. This assumes a 99 % ascent success rate for one launch. The demonstrated 
rate for the Shuttle is 96 %. For all other launch vehicles, U.S. and foreign, the 
ascent success rate is in the range of 90 %, based on many hundreds of launches. 
None do better than 96 %. Thus the 2 % chance of no ascent may be optimistic. 
On the other hand, it is hoped that special efforts will be continued which make 
the Shuttle program significantly safer and more reliable than other launch vehicle 
programs flown to date. 

Late Ascent - 0.04 - The residual. 

6.31 Event: Shuttle Rendezvous and RMS Capture - Following a successful ascent, the 

Shuttle must rendezvous with and capture the SRC. The rendezvous is a compli- 
cated (10 bums), but a well understood and practiced maneuver. 

Possible 

Results: Nominal Rendezvous and Capture - Rendezvous and RMS capture and 
placement in a canister pallet are accomplished without incident. 

Failure to Rendezvous or Capture - Due to failure of some system, perhaps one 
requiring immediate deorbit, such as a pressure vessel leak of significance or fuel 
cell problems, the sample is not captured. 

Probabilities: 

Nominal Rendezvous and Capture - 0.999 - Given a successful ascent, the 
Orbiter is redundant in almost all crucial systems. Even the RMS may possibly be 
backed up by an EVA crewman with a manned maneuvering unit, as has been 
demonstrated for a much larger communications satellite recovery. 

Failure to Rendezvous or Capture - 0.001 - The residual 
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6.32 Event: Qrbiter Handling - For the cases in which the sample is recovered directly by the 

Space Shuttle Orbiter remote manipulator system, the SCA will probably be 
removed from the SRC in the payload bay and repackaged in a sturdier container. 
A pallet such as proposed for the Freedom Space Station repackaging (see Figure 
3.6-1) may be appropriate. Once the payload bay doors are closed, active thermal 
control may be required to keep the sample at -40° C. Two failures of signifi- 
cance are possible, loss of thermal control, and contamination of the orbiter. The 
contamination of the orbiter case is ignored here, to simplify some, and because it 
is felt to be improbable. The RMS could do all the sample manipulation and even 
leave the tip or part of the RMS that touches the SRC and SCA in the SRC 
canister. 

Possible 

Results: Nominal - The SCA is repackaged without incident. 

Loss of Temperature Control - Due to an orbiter or pallet systems failure, the 
sample is not kept cold during entry and landing. 

Probabilities: 

Nominal - 0.999 - This is an estimate subject to dispute. 

Loss of Temperature Control - 0.001 - The residual. 
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7.0 Detailed Comparison of Failure Probabilities 

Table 7.0-1 is a summary of the results of the probability calculations for the various options. 
Table 7.0-2 breaks down the numbers into even more detail. The first column in Table 7.0-1 is 
the sum of the second and third columns. It is the probability of returning the sample with some 
chance of it being too warm. The container breached column in Table 7.0-1 is the sum of the 
third through the sixth columns in Table 7.0-2. The container breached column represents all 
those failures that release the Mars sample or some small fraction of it into the Earth’s biosphere. 

To get a more detailed breakdown of the results, we must return to the fault tree figures and their 
spreadsheet summary numbers for each branch or path in section five. 

Table 7.0-1, Summary of Risk Calculation Results 
(from Mid-Course to touch down) 


Option 

Sample 

Returned 

100% 

Success 

Sample 

Degraded 

Container 

Breached 

* 

Sample 

Lost 

Direct Entry 

98.15 

97.64 

0.55 

0.45 

1.36 

Prop. Capture 
to Space Sta. 

96.69 

90.38 

6.31 

0.74 

2.57 

Aerocapture to 
to Space Sta. 

96.68 

89.61 

7.07 

1.66 

1.66 

Aerocapture 

m ..i 

96.71 

91.72 

4.99 

1.62 

1.66 


to Shuttle 


Includes everything from a broken seal to the sample spread in the upper atmosphere. Also 
includes a lost unsterilized sample on Earth in a sealed container. This is the sum of the 
third through the sixth column in Table 7.0-2 on the next page. 
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Table 7.0-2, Risk Calculation Results, Detailed Breakdown 
(All numbers in %) 


Option 

100% 

Success 

Degraded 

Sample 

Canister 
Breached 
(Sample re- 
covered or 
in theory 
recoverable) 

Canister 

Breached 

(Sample 

destroyed) 

Direct Entry 

97.64 

0.55 

0.21 

0.011 

Aerocapture 
to Station 

89.61 

7.07 

0.70 

0.038 

Propulsive 90.38 

Capture to Station 

6.31 

0.001 

0.643 

Aerocapture to 
Shuttle 

91.72 

4.99 

0.73 

0.039 


Space Sta. 
Contaminated 
with Mars 
dust 

Unsteriliz. 
Lost Sample 
(On Earth) 

Steriliz. 

Lost Sample 
(On Earth) 

Lost 
Sample 
(In Space) 

Permanent 

Orbit 

- 

0.232 

0.034 

1.32 

- 

0.096 

0.817 

0.145 

1.026 

0.495 

0.097 

- 

1.962 

0.609 

- 


0.852 

0.149 

1.026 

0.495 
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8.0 Sensitivity Analysis 


The results of the fault tree analysis presented in sections 5 and 6 are the same as those of the 
simple mission complexity analysis given in section 4. Both types of analysis conclude that the 
direct entry option is the most likely to be successful. However, the estimates of probability of 
the various off-nominal results of each event presented in section 6 may be in error by as much 
as a factor of ten. Therefore a sensitivity analysis was run on the fault trees to see if the 
conclusions would be changed if any of the estimates were significantly in error. 

Sensitivity to both increases and decreases in failure probability for each event was evaluated. A 
complete probability analysis, actually the spread sheet for each fault tree, was recalculated after 
increasing each probability estimate for each off-nominal result by a factor of ten. Other runs 
raised the probability of each nominal event to 1.0 to essentially remove that event from the 
calculation. The results of these calculations are presented in Tables 8.0-1 through 8.0-4 in 
compressed form. The following figures show the sensitivity results in an easier to read format. 

Figure 8.0-1 shows a plot of the Probability of 100% success versus the probability of canister 
breach for all runs increasing and decreasing the probabilities . Note that the extreme points 
occur for all options except direct entry. Figure 8.0-2 is a close up of the previous figure. Note 
that with the exception of two cases, the direct entry cases all form a cluster with a probability of 
100% success of about 97.5% and a probability of canister breach of less that 1/2%. In order to 
clarify this point Figure 8.0-3 shows only the direct entry points. Thus the inference of the 
previously presented analysis that the direct entry method is preferred is confirmed. The better 
performance of direct entry is not sensitive to the specific values of the probability estimates. 

Figures 8.0-5 through 8.0-23 are bar graphs showing in graphical form the effect of varying the 
individual probabilities. These plots show that only 15 of the 32 different entry events produce a 
significant effect when probabilities are raised or lowered. Significant effect is defined here as 
producing a change greater than roughly 30% of the baseline case in the probability of mission 
success, breach of sample, etc. Table 8.0-5 shows these fifteen events and the options that they 
affect. 

Table 8.0-6 shows a somewhat different list of key results compiled by examining the paths or 
branches in the fault trees that contributed the most to failure probabilities for the various 
options. The results are shown in Table 8.0-6 with probabilities. 
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Sensitivity Analysis for Direct Entry 
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Table 8.0-2, Sensitivity Analysis for Aerocapture to Freedom Space Station 
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37 OIV lec. 

4.24 

lonin. 

t 

97.34 

91.45 

0.94 

5.09 

1.13 

0.10 

0.49 


ft Probabilities raised to 1 


1001 Canister S.S. 

Hen Changed Factor Success Success Breached Degraded Lost Sai. Contai. Pern Orb 



none 



0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.10 

1 Mid C. 

(.1 

ligk-G 

iie 

-0.04 

-0.1) 

1.20 

-0.14 

5.90 

0.00 

0.00 

2 lid C. 

(.1 Miss Bart 

zlO 

-9.00 

-0.99 

-0.97 

-MS 

760.60 

-16.00 

-1.16 

3 lid C. 

6.1 

lonin. 

ft 

1.01 

1.02 

0.64 

0.9) 

-04.62 

0.00 

2.04 

4 Irk -up 

6.2 

Unster. 

ft 

0.00 

0.00 

6.41 

0.00 

-1.55 

0.00 

0.00 

5 Brk-up 

6.2 

Ster. 

ft 

0.00 

0.00 

-2.56 

0.00 

2.56 

0.00 

0.00 

4 latt 

6.3 

<or= 1 

zlO 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

3 latt 

6.3 

>or= 2 

t 

0.00 

0.00 

0.01 

0.00 

0.00 

0.00 

0.00 

1 UV Ibis 

6.4 

Falls 

ft 

0.01 

0.00 

1.21 

0.14 

-2.56 

0.00 

0.00 

3 UV Ini 

6.4 

lonin. 

« 

M0 

0.00 

-0.64 

0.00 

0.00 

o.eo 

0.00 

10 Unctrl. B 

6.5 

Itkap 

zlO 

•0.40 

0.00 

-2M5 

-5.52 

70.94 

0.00 

0.00 

11 Unctrl. K 

6.5 

Inpact 

ft 

0.04 

0.00 

3.21 

0.57 

-1.69 

0.01 

e.oe 

12 lo Ch. In 

6.6 Breached 

i 

0.36 

0.00 

-22.44 

4.95 

0.08 

M0 

0.00 

13 Is Ck. Is 

6.6 

Intact 

i 

-0.15 

0.00 

51.92 

-11.60 

0.00 

0.00 

0.00 

14 Src. lo I 

6.1 

Lost 

i 

-0.01 

0.00 

51.92 

-11.03 

-3.42 

0.00 

0.00 

IS Sic. Is 2 

6.7 

Found 

t 

0.11 

0.00 

-52.51 

11.03 

3.42 

0.00 

0.00 

H UV Sep 

6.0 

Fails 

lio 

-0.34 

-0.36 

0.64 

-0.14 

27.35 

M0 

0.00 

13 uv Sep 

6.0 

lonin. 

ft 

1.04 

0.04 

-0.61 

0.00 

-2.56 

0.00 

0.00 

11 leiscap 

6.10 Barly Bz. 

111 

-4.50 

-4.51 

-3.05 

-4.31 

-3.42 

-10.00 

910.20 

1) leiscap 

6.10 

lo Bzlt 

111 

-2.97 

-4.51 

176.20 

16.55 

11.11 

-10.00 

0.00 

26 keiscap 

6.10 

Ionia. 

1 

0.15 

1.02 

-19.23 

-1.27 

-1.71 

0.00 

-100.00 

21 Oik. 1. 

6.11 

Failure 

zlO 

-0.47 

-0.91 

2.56 

5.09 

35.90 

0.00 

0.00 

22 Oib. 1. 

6.10 

lonin. 

ft 

0.05 

0.10 

-0.(4 

-0.51 

-3.42 

0.00 

0.00 

23 Oik la. 

6.19 

Crash 

zlO 

-Ml 

-0.90 

0.00 

11.32 

0.00 

0.00 

0.00 

21 Oik Is. 

6.19 

lonin. 

t 

0.05 

0.10 

-0.64 

-0.51 

-3.42 

0.00 

0.00 

2S Oib. kik 

(.20 Uosteril. 

zlO 

-0.02 

0.00 

2.56 

-0.20 

-2.56 

0.00 

0.00 

2i Oik. kik 

6.20 

Steril. 

t 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

27 Pal. bit 

6.21 Can Brch 

ill 

-0.01 

0.00 

0.00 

-0.14 

0.00 

0.00 

0.00 

21 Pal. kik 

6.21 

lo Brch 

t 

0.00 

0.00 

0.00 

1.00 

0.00 

0.00 

0.00 

2) S.S. Pis. 

6.22 Tenp Fail 

zlO 

0.05 

-3.63 

-0.64 

46.60 

0.00 

0.00 

0.00 

31 S.S. Pis. 

6.22 

Contai. 

xlO 

-1.34 

-1.39 

-0.64 

-0.71 

-2.56 

160.00 

0.00 

31 S.S. Pis. 

6.22 

lonin. 

t 

0.01 

0.41 

0.00 

-5.09 

0.00 

0.00 

0.00 

12 OIV Oep. 

6.23 

Fails 

ilO 

0.01 

-47.09 

-0.64 

607.07 

0.60 

0.00 

0.00 

33 OIV Oep. 

6.23 

Slov 

xlO 

-6.02 

-9.59 

352.56 

39.10 

23.00 

-10.00 

0.00 

31 OIV Oep. 

6.23 

lonin. 

t 

0.60 

6.3) 

-39.74 

-71.71 

-3.42 

0.00 

o.oe 

IS OIV lec. 

6.24 

Slov 

xie 

-0.01 

-9.20 

-0.64 

116.41 

0.00 

0.00 

0.00 

K OIV lec. 

6.24 

Falls 

xlO 

-6.02 

-9.20 

352.56 

34.23 

21.21 

-10.00 

0.00 

37 OIV lec. 

6.24 

lonin. 

i 

0.60 

2.05 

-39.74 

-16.69 

-3.42 

0.00 

0.00 
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Table 8.0-3, Sensitivity Analysis for Aerocapture to Shuttle 


lev Probabilities \ change 


Itei Changed 

Pactor 

100% Canister 
Success Saccess Breached 

Degrade 

Lost Sa Pera Orb. 

Itea Changed 

Pactor 

1001 Canister 
Saccess Success Breached 

Degrade 

Lost Sa Pera Orb 


1001 



94.71 

91.72 

1.42 

4.99 

1.17 

0.49 


noae 


6.00 

0.00 

0.60 

0.06 

0.00 

M0 

Mid C. 

6.1 

lit Barth 

ill 

95.52 

91.43 

1.44 

4.99 

1.24 

0.49 

1 Mid C. 

5.1 lit Barth 

xlO 

“0.09 

-0.16 

1.23 

0.06 

5.91 

0.00 

Mid C. 

M 

Miss Bart 

xlO 

11.00 

13.44 

1.41 

4.54 

10.07 

0.45 

2 Mid C. 

5.1 Miss Batt 

xlO 

-9.11 

-9.01 

-M4 

-9.12 

760.61 

-1.16 

Hid C. 

(.1 

loiia. 

t 

97.41 

92.54 

1.44 

5.04 

0.10 

0.50 

3 Mid C. 

4.1 loaln. 

ft 

1.00 

1.00 

1.23 

l.ll 

-04.62 

2.04 

Bit-up 

(.2 

Oosterll. 

t 

94.71 

91.72 

1.13 

4.99 

1.07 

0.49 

4 Bit-pp 

4.2 Uasterll. 

» 

0.00 

Ml 

6.79 

M0 

-1.55 

0.00 

Brt-ep 

(.2 

Steril. 

t 

94.71 

91.72 

1.5! 

4.9! 

1.21 

0.49 

5 Brk'flp 

5.2 Steril. 

a 

0.08 

Ml 

-1.15 

Ml 

3.42 

Ml 

Batt 

(.3 

<01= 1 

xlO 

95.71 

91.72 

1.42 

4.99 

1.17 

0.49 

4 Batt 

4.3 <ot= 1 

xlO 

0.01 

0.10 

0.00 

0.06 

0.00 

0.00 

Batt 

(.3 

>oi= 2 

t 

95.71 

91.72 

1.42 

4.99 

1.17 

0.49 

7 Batt 

pm 

is 

K* 

ft 

0.08 

Ml 

M0 

0.00 

0.11 

M0 

BBV Bom 

S.l 

Pails 

t 

95.72 

91.72 

1.55 

5.00 

1.14 

0.49 

1 MV Burn 

5.4 Pails 

t 

0.11 

0.00 

1.15 

0.20 

-2.51 

Ml 

MV Beta 

(.4 

loaia. 

t 

95.71 

91.72 

1.52 

4.99 

1.11 

0.49 

9 MV Bma 

5.4 loaia. 

ft 

0.08 

M0 

0.00 

M0 

0.15 

M0 

Unctild B 

4.5 

Irtnp 

xlO 

94.31 

91.72 

1.14 

4.59 

2.04 

0.49 

10 Unctrld B 

5.5 Bckop 

xlO 

-0.41 

0.10 

-20.40 

-0.02 

71.36 

0.00 

Uactild 1 

(.5 

Intact 

t 

94.75 

91.72 

1.57 

5.04 

1.01 

0.49 

11 Unctrld B 

5.5 Intact 

ft 

0.05 

Ml 

3.19 

1.00 

-7.69 

0.10 

Mo Cb lip 

6.5 

Intact 

ft 

97.01 

91.72 

1.25 

5.35 

1.17 

0.49 

12 lo Ch lap 

4.4 Intact 

ft 

0.38 

0.00 

-22.22 

7.41 

0.00 

M0 

Mo Cb lap 

4.5 

Breached 

ft 

95.15 

91.72 

2.40 

4.14 

1.17 

0.49 

13 lo Cb lap 

4.5 Bleached 

ft 

-0.88 

1.10 

53.09 

-17.03 

0.00 

0.00 

Sic. Mo Z 

5.7 

Lost 

ft 

95.90 

91.72 

2.41 

4.10 

1.13 

0.49 

14 Src. lo 1 

4.7 Lost 

ft 

-0.84 

0.01 

53.89 

-16.23 

-3.42 

0.00 

Src. lo I 

4.7 

Pound 

a 

97.52 

91.72 

0.77 

5.10 

1.22 

0.49 

15 Src. lo I 

4.7 Pound 

t 

1.84 

0.00 

-52.47 

16.23 

4.27 

M0 

MV Sep 

l.t 

Pails 

xlO 

95.30 

91.39 

1.44 

4.19 

1.50 

0.49 

15 SfiV Sep 

4.B Pails 

xll 

-0.34 

-0.35 

1.23 

6.00 

21.21 

0.00 

MV Sep 

4.1 

loaia. 

a 

95.74 

91.75 

1.52 

4.99 

1.14 

0.49 

17 BIV Sep 

5.8 loilo. 

ft 

’ 0.03 

M3 

0.00 

0.00 

-2.56 

0.00 

ierocap 

4.10 Barly Bi. 

xlO 

92.32 

17.55 

1.55 

4.77 

1.17 

4.95 

18 lerocap 

5.10 Early 8x. 

xlO 

-4.54 

-4.55 

-3.70 

-4.41 

0.00 

910.20 

ieiocap 

5.11 

lo Bilt 

xlO 

93. BO 

07.55 

4.37 

4.25 

1.34 

0.49 

19 ierocap 

4.10 lolxit 

xlO 

-3.01 

-4.55 

169.75 

25.25 

14.53 

0.00 

ieiocap 

4.10 

loaia. 

ft 

97.52 

92.44 

1.32 

4.00 

1.15 

0.00 

20 ierocap 

5.10 loaia. 

ft 

0.14 

1.00 

-11.52 

-2.20 

-0.15 

-100.00 

Orb. B. 

4.11 

Pailate 

xlO 

95.25 

90.19 

1.57 

5.35 

1.51 

0.49 

21 Orb. B. 

5.11 Pal lore 

xlO 

-0.41 

-0.90 

3.09 

7.41 

35.04 

Ml 

Orb. 1. 

4.11 

loaia. 

t 

95.10 

91.11 

1.42 

4.99 

1.10 

0.49 

22 Orb. B. 

5.11 loaia. 

ft 

0.09 

0.10 

0.00 

0.00 

0.15 

0.00 

Oib la. 

4.13 

Crash 

xlO 

95.70 

91.19 

1.53 

5.01 

1.17 

0.49 

23 Orb In. 

4.19 Crash 

xlO 

-0.01 

-1.90 

1.62 

16.43 

0.00 

Ml 

Orb la. 

4.19 

loaia. 

t 

94.71 

91.11 

1.42 

4.90 

1.17 

0.49 

24 Orb la. 

5.19 loaia. 

i 

0.00 

0.10 

0.00 

-1.00 

0.00 

0.00 

Orb. bit 

4.20 

Uasterll. 

xll 

95.59 

91.72 

1.47 

4.97 

1.15 

0.49 

25 Orb. brt 

4.20 Uasterll. 

xll 

-0.02 

0.00 

3.09 

-0.40 

-1.71 

0.00 

Oib. bit 

5.20 

Steril. 

ft 

95.71 

91.72 

1.42 

4.99 

1.10 

0.49 

25 Oib. bit 

5.20 Steril. 

ft 

1.00 

0.00 

0.00 

0.00 

0.15 

M0 

Pal. bit 

4.21 

Cao firch. 

xll 

94.70 

91.72 

1.43 

4.91 

1.17 

0.49 

27 Pal. fart 

4.21 Can Bich. 

III 

-0.01 

0.66 

6.52 

-0.21 

0.66 

0.06 

Pal. brt 

4.21 

Degraded 

1 

95.71 

91.72 

1.52 

4.99 

1.17 

0.49 

28 Pal. bit 

5.21 Degraded 

ft 

0.64 

Ml 

0.00 

0.00 

1.06 

0.00 

Pei. 1 

5.25 

Palls 

III 

95.45 

91.43 

1.51 

5.02 

1.10 

0.49 

29 Pet. 1 

5.25 Pails 

xlO 

-0.05 

-0.10 

3.70 

0.60 

0.15 

M0 

Pei. 1 

4.25 

loaia. 

I 

94.71 

91.72 

1.52 

4.99 

1.17 

0.49 

30 Pet. 1 

(.25 lonlo. 

ft 

0.00 

0.00 

0.00 

0.00 

0.00 

0.00 

Shat, isc 0.30 

Late 

xlO 

95.71 

54.59 

1.52 

40.12 

1.17 

0.49 

31 Shit, isc (.31 Late 

ill 

Ml 

-31.31 

e.io 

704.01 

0.00 

M0 

Shut, isc 0.30 

Too Late 

xlO 

14.95 

74.15 

12.72 

10.01 

1.03 

0.49 

31 Shat. Isc (.30 Too Lite 

xlO 

-12.15 

-19.15 

615.19 

116.63 

56.41 

0.00 

Sbit. isc 0.30 

loaia. 

ft 

91.01 

97.57 

0.39 

0.44 

1.10 

0.49 

33 Shat, isc (.31 loiia. 

ft 

1.34 

6.31 

-75.93 

-91.10 

-5.91 

0.00 

Shot. EM 0.31 

Pails 

xlO 

95.13 

90.19 

2.17 

5.24 

1.21 

0.49 

3< Shat. 1(1 (.11 Fails 

xll 

-0.50 

-0.90 

33.95 

5.01 

3.12 

M0 

Shat. EM 0.31 

loaia. 

t 

95.77 

91.11 

1.54 

4.95 

1.17 

0.49 

35 Shat. Id (.31 loiln. 

ft 

0.05 

0.10 

-3.70 

-0.60 

0.00 

1.00 

Orb. Sai 

5.32 

Teap Pail 

xlO 

95.72 

90.89 

1.42 

5.13 

1.17 

0.49 

35 Orb. Haa 

(.31 Tup Foil 

xlO 

0.01 

-0.90 

0.00 

16.13 

0.00 

0.00 

Oib. Has 

4.32 

loaia. 

ft 

95.71 

91.11 

1.42 

4.90 

1.17 

0.49 

37 Otb. Ban 

(.32 loiia. 

i 

0.00 

0.10 

M0 

-l.ll 

0.00 

1.01 


1 Probabilities raised to i 
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Table 8.0-4, Sensitivity Analysis for Propulsive Capture to Freedom Space Station 


lev Piobabi 1 itles \ change 

im Canister 100% Canister 

Itei Changed Factor Success Soccess Breached Degrade Lost Sa S.S. Co. Itei Changed Factor Success Success Breached Degrade Lost Sa S.S. Co 



none 



90.09 

99.31 

9.(4 

0.31 

2.57 

0.09 


none 



9.00 

0.00 

9.00 

0.00 

0.00 

0.00 


1 Mid C. 

(.1 lit Barth 

>10 

92.29 

10.27 

1.7$ 

0.92 

$.97 

0.99 

1 Hid C. 

0.1 lit Barth 

xlO 

-4.55 

-4.55 

173.44 

-4.(0 

128.40 

0.00 


2 Mid e. 

(.1 Hiss Bart 

xlO 

92.29 

10.27 

9.02 

0.92 

0.99 

0.09 

2 Mid C. 

(.1 Kiss Bart 

xlO 

-4.55 

-4.55 

-3.13 

-4.(0 

171.98 

1.00 


3 Hid C. 

f.l 

loiin. 

t 

97.00 

91.29 

9. $2 

(.37 

1.71 

9.10 

3 Kid C. 

(.1 

Ionia. 

t 

1.09 

1.91 

-11.75 

0.95 

-33.40 

11.11 


4 Brk-ip 

(.2 Unsteril. 

i 

90.09 

99.31 

2.50 

(.31 

0.(5 

0.10 

4 Brk-op 

(.2 Unsteril. 

t 

9.00 

0.00 

300.99 

0.00 

-74.71 

11.11 


5 Brk-np 

0.2 

Steril. 

i 

90.09 

99.31 

1.01 

0.31 

3.21 

9.19 

5 Brk-op 

(.2 

Steril. 

t 

0.00 

(.10 

-98.44 

0.00 

24.91 

11.11 


0 Batt 

(.3 

<or= 1 

xlO 

90.09 

99.31 

9.04 

0.31 

2.57 

9.10 

0 Batt 

(.3 

<or= 1 

xlO 

0.09 

9.00 

9.00 

0.00 

0.00 

11.11 


7 Batt 

(.3 

>or= 2 

t 

90.09 

90.31 

9.(4 

0.31 

2.57 

0.10 

7 Batt 

0.3 

>tl= 2 

a 

0.00 

0.00 

0.00 

0.00 

0.00 

11.11 


1 Sic. I« I 

0.7 

Lost 

t 

90.73 

99.31 

9.04 

0.3$ 

2.53 

9.10 

1 Sic. Mo I 

(.7 

Lost 

t 

0.04 

0.00 

9.00 

0.(3 

-1.50 

11.11 


9 Src. Bo I 

0.7 

Foond 

t 

92.99 

99.31 

9.04 

0.27 

2.(1 

0.10 

9 Src. In 1 

(.7 

Foond 

t 

-3.93 

0.00 

0.00 

-0.03 

1.50 

11.11 

Q 

ft --'r 

10 81V Sep 

O.t 

Fails 

xlO 

90.33 

99.9$ 

9.04 

0.29 

2.92 

0.10 

10 BIV Sep 

0.9 

Falls 

xlO 

-0.37 

-0.37 

0.00 

-0.41 

13.02 

11.11 


u ny sep 

0.1 

Bovin. 

i 

90.73 

99.42 

0.04 

0.31 

2.53 

0.10 

11 88V Sep 

(.1 

loiin. 

t 

9.94 

9.04 

0.19 

0.00 

-1.50 

11.11 


12 Orb. I. 

0.11 

Vaileie 

xlO 

90.23 

19. $7 

0.0) 

0.00 

2.99 

0.10 

12 Orb. B. 

(.11 

Failure 

xlO 

-0.41 

-0.90 

7.81 

5.55 

15.95 

11.11 

O 

Vs, 

13 Oib. I. 

0.11 

loiin. 

t 

90.74 

90.47 

0.04 

0.27 

2.53 

0.19 

13 Oib. 1. 

(.19 

lonln. 

i 

9.05 

0.10 

0.09 

-0.03 

-1.50 

11.11 

kit* 

14 Orb U. 

0.19 

Crash 

xlO 

90.01 

99. $7 

9.0$ 

7.11 

2.57 

0.10 

14 Orb la. 

(.19 

Crash 

xlO 

-0.91 

-0.90 

1.50 

12.08 

0.00 

11.11 


lb Orb In. 

0.19 

loiin. 

t 

90.09 

99.47 

0.04 

0.22 

2.57 

9.10 

15 Orb In. 

(.19 

loiin. 

i 

9.00 

0.10 

0.00 

-1.43 

0.08 

11.11 

,o 

16 Orb. brk 

0.20 Unsteril. 

xlO 

90.07 

90.39 

0.09 

0.2) 

2.55 

0.19 

10 Orb. brk 

(.29 Unsteril. 

xlO 

-0.02 

0.00 

7.81 

-0.32 

-0.78 

11.11 

i.-. 

17 Orb. brk 

0.20 

Steril. 

i 

90.09 

99.31 

9.04 

0.31 

2.57 

9.10 

IT Oib. bit 

(.20 

Steril. 

t 

0.00 
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Figure 8.0-1, Scatter for all Sensitivity Runs (Plot includes all points) 


All Cases 



40 60 80 100 

100% Success (%) 

+ Direct Entry o Propulsive Cap. a Orbiter R Sc R * Aerocapture to S.S. 


98 



Figure 8.0-2, Scatter for All Sensitivity Runs (Plot includes most points) 
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Figure 8.0-3, Scatter for Direct Entry Sensitivity Runs (Plot includes all Direct Entry points) 
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Figure 8.0-5, Sensitivity Plot for Direct Entry, Per Cent Change for Degraded Sample 
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Figure 8.0-6, Sensitivity Plot for Direct Entry, Per Cent Change for 100% Success 
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Figure 8.0-7, Sensitivity Plot for Direct Entry, Per Cent Change for Canister Breach 
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Figure 8.0-8, Sensitivity Plot for Aerocapture to the Freedom Space Station Per Cent Changed 
for Lost Sample 
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Figure 8.0-9, Sensitivity Plot for Aerocapture to the Freedom Space Station, Per Cent Change 
for Degraded Sample 




1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 


Event Number 


106 



Percent Change (%) 


Figure 8 . 0 - 10 , Sensitivity Plot for Aerocapture to the Freedom Space Station, Per Cent Change 
for 100% Success 
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Figure 8.0-11, Sensitivity Plot for Aerocaptuie to the Freedom Space Station, Per Cent Change 
for Canister Breach 
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Figure 8.0-12, Sensitivity Plot for Aerocapture to the Freedom Space Station, Per Cent Change 
for Station Contamination 
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Figure 8.0-13, Sensitivity Plot for Aerocapture to the Freedom Space Station, Per Cent Change- 
for Permanent Orbit 
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Figure 8.0-14, Sensitivity Plot for Aerocapture to the Shuttle, Per Cent Change for Lost Sample 
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Figure 8.0-15, Sensitivity Plot for Aerocapture to the Shuttle, Per Cent Change for Degraded 
Sample 
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Figure 8.0-16, Sensitivity Plot for Aerocapture to the Shuttle, Per Cent Change for 100% 
Success 
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Figure 8.0-17, Sensitivity Plot for Aerocapture to the Shuttle, Per Cent Change for Canister 
Breached 
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I Figure 8.0-18, Sensitivity Plot for Aerocapture to the Shuttle, Per Cent Change for Permanent 
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Figure 8.0-19, Sensitivity Plot for Propulsive Capture to Freedom Space Station, Per Cent 
Change for Lost Sample 


260 


Percent Change of Lost Sample 


240 - 
220 - 
200 - 
180 - 
160 - 
140 - 
120 - 
100 - 
80 - 
60 - 
40 
20 H 
0 

- 20 - 
-40 - 
-60- 
-B0 


V\ 

/ 

/ 

tn/ 
/ / 
/ / 
// 
/ / 
// 
// 
// 
/ / 
// 


1 Mid Course-Hit Earth 
prob. x 10 

2 Mid Course-Miss Earth 
prob. x 10 

4 Break-Up-Unsterilized 
prob. raised to 1 

24 0MV Deployment-Fails 
prob. x 10 

27 0MV Recovery-Fails 
prob. x 10 


171 

/ 


TV I 
// 
Ed/ 
/ 
/ 
/ 


ELa 


IT 1 , 

/ 

✓1 

/\ 

<1 


i/i 

/ 

i/ 

/ 

/ 

A 


M A 



A 

/ 

A 

Z 1 

A 

A 

A 

v 

A 

A 

A 

A 

A. 

A 

i/I 

d 

/ 

I - / 

A A 


/i 




A, 

A 




l 


11 13 15 17 19 21 23 25 27 29 31 33 


Event Number 


116 







Percent Change (%) 






Figure 8.0-22, Sensitivity Plot for Propulsive Capture to Freedorr 
Change for Canister Breach 
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Table 8.0-5, The 15 Most Significant Events 


Option that has significant sensitivity to the Event: 


Event 

Chapter 

Direct 

Entry 

Aerocap. 
to Sta. 

Aerocap. 
to Shuttle 

Propul. Cap. 
to Sta. 

Mid Course 

6.1 

X 

X 

X 

X 

Break-up 

6.2 




X 

Uncontrolled Entry 

6.5 


X 

X 


No Chute Impact 

6.6 


X 

X 


Search for SRC 
Out of Zone landing 

6.7 


X 

X 


ERV Separation 

6.8 


X 

X 


Direct Entry 

6.9 

X 




Aerocapture 

6.10 


X 

X 


Air Snatch 

6.14 

X 




Orbiter Entry 

6.18 



X 


Space Sta. Proc. 

6.22 




X 

OMV launch and departure 

6.23 


X 


X 

OMV Recovery 

6.24 


X 


X 

Shuttle Ascent 

6.30 



X 


Shuttle Rendez. and 

6.31 



X 



Recovery 
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Table 8.0-6, Events That Dominate Major Paths in the Fault Trees 
(Nominal probability estimate shown) 

1. Direct Entry 

Successful Air snatch -97% 

Nominal Midcourse - 99% 

Nominal Entry - 99% 

Breach after no chute impact - 30% 

2. Aerocapture to Orbiter 

On-time Shuttle Ascent - 94% 

Nominal Midcourse - 99% 

Nominal Aerocapture - 99% 

Breach after uncontrolled entry - 30% 

3. Aerocapture to Freedom Space Station 

OMV launch and deploy on time - 94% 

OMV nominal recovery of SRC - 98% 

Nominal Aerocapture - 99% 

Nominal Midcourse - 99% 

4. Propulsive Capture to Freedom Space Station 

OMV launch and deploy on time - 94% 

OMV nominal recovery of SRC - 98% 

Nominal Aerocapture - 99% 

Nominal Midcourse - 99% 

Sterilization during uncontrl. entry - 25% 
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9.0 Planetary Protection Policy 

At the start of this study the authors reviewed a series of documents to try to determine the 
official policy of the U.S. government toward return of extraterrestrial materials and possible 
back-contamination hazards. The policies for controlling spacecraft outbound from Earth to 
other planetary bodies seemed well defined, but the policy with regard to inbound flights were 
not adequately defined in the documents reviewed to present either design requirements or 
standards by which candidate designs could be evaluated. 

Attitudes toward the problem are represented by two extremes: 

There is no life on Mars, don’t let this issue impact the program. 

Any risk above zero is unacceptable. The benefits to the public are not worth any risk. 

The authors of this study tend to be somewhere in the middle, leaning toward minimizing risk. 
Although the probability of living material on Mars is viewed as vanishingly small, the possibili- 
ty does exist. The probability that life previously existed on Mars when it had liquid water on 
the surface and a more hospitable climate is much higher. One of the principle motivations to 
pursue a Martian sample is to find evidence of that life. It is physically impossible to return a 
sample in which to study past life which is 100% certain to be free of current Mars life, should it 
exist. Zero risk is not possible for a sample return mission. We must be willing to accept a 
small risk. If there is Martian life, it cannot be studied without some risk, but there are poten- 
tially great benefits from this study. 

The precedents for handling extra-terrestrial materials were set in the Apollo program where 
biohazards were considered. Zero risk was not achievable though it was sought. The material 
was simply handled with equipment and procedures similar to those used to confine known 
deadly terrestrial pathogens in biological containment laboratories. The sample was isolated 
biologically as were all that came in contact with it. Such procedures can be implemented at a 
modest cost relative to other aspects of the mission. 

There are other precedents in the handling of known terrestrial pathogens such as the remaining 
viable smallpox vims. Keeping some smallpox vims available for study involves some small 
risk to the population of Earth as a whole. However, the study of the material has been deemed 
to outweigh any risks associated with its presence. 

What is an acceptable risk? Another way to phrase the question is - what is a risk the American 
public will accept. It is worthwhile mentioning that all previous sample returns (6 Apollos and 3 
Lunas) were direct entries with risks on the order of or greater than those tabulated for direct 
entry in this report. Convincing arguments have been presented that several meteorites found on 
Earth came from Mars. These meteorites have fallen in all regions of the Earth including India 
France, Antarctica, and other locations. All arrived via direct entry and none have induced any 
pathologic symptoms. 
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Table 9.0-1 tabulates typical risks faced by the public in everyday life. An acceptable risk in the 
high range is roughly one in one million. This is the chance of a fatal accident on a commercial 
aircraft flight or roughly the chance of an individual getting struck by lightning in a year. The 
authors propose this as a first cut acceptable risk for releasing Martian life on Earth, to be 
weighed against the benefits. 

Table 9.0-1, Typical Risks 
(Hutt, 1978) 

1/4,500 - risk of death/year/indiv. in auto accid. 

1/2,000,000 - risk of death/year/indiv. from lightning 
1/13,000 - risk of death/year/indiv. from fall 
1/300 - risk of death/year/indiv . from smoking 

Given that the risk of breach of container in the Earth’s biosphere is calculated as roughly 1/2% 
or 5 in 1,000 for direct entry (the best option) it must be reduced to approach 1 in 1,000,000. 

One reduction factor for this risk could be a multiplier applied for the probability that Martian 
life exists, will be found in the sample in quantity, can survive transport, can reproduce and do 
damage on Earth, etc. This all seems unlikely at the moment leading the authors to propose a 
1/100 or 1/1,000 multiplier. More study of this issue by an exobiologist is needed. 

Other risk reduction measures are proposed in the next chapter. More work and the software 
developed in this study can quantify these effects on the risk of container breach. 
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10.0 Risk Reduction Measures 


The following measures can significantly reduce the risk of sample canister breach and of back- 

contamination of Earth. 

1. Redundant air snatch aircraft will increase the probability of a successful air snatch from 
97% to 99.91%. This does not affect the chance of container breach, since the container 
will be designed to land unharmed with a chute, but the risk of loss of thermal control will 
be significantly reduced. 

2. Retain ability to miss Earth as long as possible - just before entry or ERV separation. Any 
failure that might increase the risk of container breach would be cause to fly by. 

3. Redundancy in all critical systems in the ERV and SRC. For risk of canister breach, a 
highly internally redundant single mission is better than a dual mission. A completely dual 
pair of missions may get the chance of mission success from 80% up to 96% but it will 
double the risk of canister breach. 

4. Toughen the SCA for no seal loss in a no chute impact. Though likely to be expensive in 
terms of weight, this a highly testable option. Low weight options, such as placing the 
sample in some kind of rugged, flexible bag may also work. 

5. Flight test of the direct entry or aerocapture system would increase confidence in single 
point failure items such as the thermal protection systems. 

6. Toughen the SCA to insure sterilization in an entry breakup. A rugged SCA will retain the 
sample long enough for it to be sterilized by the heat of re-entry in a break-up situation. 

7. Add a sterilization system in the SCA. A chemical heater (phosphorus grenade?) would be 
placed in the SCA to be ignited in the event of unplanned failures. The sample would be 
heat sterilized. 

8. Add equipment (TV cameras?) to monitor the sterile transfer in Mars orbit. Any anomaly 
would result in cancellation of the sample return. 

9. If any sign of life is seen on Mars, cancel the sample return until more secure systems are 
built. 

10. Long life parking orbit - at least 650 km (350 nm). The OMV can retrieve 800 Ibm from 
approximately 1,850 km (1,000 nm) orbits. This would get the orbital lifetime up to tens 
of years, allowing many chances to go get the sample. This will significantly reduce the 
risk of canister breach for the Earth orbit options, but will not affect the risk of degraded 
sample or overall mission success much. 

Figure 10.0-1 and 10.0-2 show decay times for ballistic numbers typical of aerocapture and 
propulsive capture options. 
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The decay times are very much a function of the solar flux/sunspot cycle and the expansion 
of the atmosphere that results from high flux/sunspot times which occur every eleven years 
and last for three or four years. The last few peak years have been 1948, 1958, 1969, and 
1980. 1980 + 22 = 2002. If the mission departs in 1998, it will return roughly three years 
later in 2001. It will therefore arrive as sunspot activity is rising toward the peak, at the 
start of 3 or 4 years of high flux and expanded atmosphere. Lines number 3 and 4 in the 
figures are therefore applicable for lifetime prediction. 

11. Redundant means to retrieve the SRC from orbit, such as an expendable with an SRC 
catcher of some kind would up the chance of retrieval success into die 99% range, but at 
great expense. 

12. Permanent basing of an OMV at the Freedom Space Station will remove part of the ascent 
problem. The retrieval will be less dependant on an on-time launch, however a 51L 
accident may put the station out of action anyway. The crew may return to Earth in an 
emergency return device. 
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Figure 10.0-1, Orbital Decay Time, Aerocapture Option 
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Figure 10.0-2, Orbital Decay Time, Propulsive Capture Option 



11.0 Conclusions and Recommendations 


The following conclusions and recommendations resulted from this study: 

1. The direct entry option is the best choice of the four in all areas of comparison studied 
here. It has the best chance of 100% mission success, least chance of canister breach and 
loss of thermal control. It is the least expensive, has less program risk and is by far the 
simplest. All previous sample returns (6 Apollos and 3 Lunas) were direct entry missions 
and the public did not object. Other comparison areas, such as weight, were not addressed. 

2. Measures can be taken to significantly reduce the risk of canister breach below the 0.45% 
calculated for direct entry. These include: 

a) Redundant subsystems in the ERV and SRC 

b) Dual main and drogue chutes (already included in the calculations) 

c) SCA capable of maintaining seals in a no chute impact 

d) Ability to flyby Earth until ERV separation 

e) Flight test for entry vehicle 

f) Redundant air snatch aircraft 

3. Other measures that can reduce the probability of back-contamination for all options 
include: 

a) Cancellation of sample return portion of the mission if any signs of life are found on 
Mars. 

b) Equipment (cameras) to monitor the sterile transfer in Mars orbit. Any detected 
anomaly in the sterile transfer process would result in leaving the sample in Mars 
orbit. 

4. If the options using Earth orbit parking are used, use a parking orbit with a long decay 
time, in the range of tens of years. 

5. The orbital decay figures shown in Figures 10.0-1 and 10.0-2 are from a low-fidelity 
simulation. A more sophisticated decay model should be used to verify decay time versus 
altitude, year, and ballistic number. 

6. Certain event probabilities could be improved with more research. These include: 

a) OMV launch and deployment (section 6.23) - a key event 

b) Shuttle ascent (section 6.30) - also key 

c) Go on batteries (section 6.3) - better numbers can be obtained 

d) Mid Course (section 6.1) - the probability of hitting Earth after a miss on subsequent 
orbits around the sun should be computed 

e) EOI bums (6.27 and 6.28) - Motor reliability can be better determined 
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7. If the biological material in the sample is assumed to carry its genetic information in long 
chain molecules, it can be heat sterilized. A heat sterilization procedure needs to be 
developed and agreed upon. 

8. The weight penalties associated with the following proposals should be determined. 

a) Sterilization system (phosphorus grenade?) inside the sample container to be fired in 
the event of failures. 

b) Protection material or containment package required in order to allow the SRC to hit 
hard ground with no chute and not release the sample. Some very light mylar or 
kevlar bag may be all that is needed. 

c) Sample container that will heat the sample to the required sterilization conditions 
before it breaks up. 

9. The probability of a vehicle’s on-time ascent to LEO to retrieve the SRC is a key number 
unavailable at present to the authors. Simple ascent success probability is given in Table 
6.29-1. Successful ascent within a specified schedule also needs to be tabulated. 
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